Code review

Remove custom String() functions, dump config in verbose logging only

Move token auth failure logging into failure handler

Validate state, redirect inside success handler, add success handler chain