Set state by default?
Now that I think of it, we should just generated random `state` by default, right? This is the secure approach and grant is already using session (which it might as well use to store `state`).

Any reason for us to do a dynamic overwrite manually?
