Require state + state validation
Is it possible for some providers to _require_ state and ensure that the state gets validated?

It appears that in both the [latest version](https://github.com/simov/grant/blob/v5.4.9/lib/flow/oauth2.js#L68) and in [previous versions](https://github.com/simov/grant/blob/v4.7.0/lib/flow/oauth2.js#L68) we only validate `state` if it is present in both the `authorize` object and `session` object.
