Properly use the state parameter when auth'ing

[philip-gai]

See this comment: #82 (comment)

We may need to:

• Use a secret in the state
• Use a timestamp in the state
• Use some other kind of salt in the state