Store state and nonce in session and verify id_token correctly