Allow clients to specify a "state" parameter which is returned after authorization, like in OAuth 2.0.

If a `client_id` is specified in the initial auth request, the code is returned in a parameter named "code" instead of "token".
implements endpoint for resources servers to verify auth codes
Auth codes are valid for 30 seconds instead of one-time use.
Support passing in a "scope" parameter to the OAuth grant which is then return when verifying an auth code.
auth requests respond with form-encoded replies instead of json