`state` parameter is useless as-implemented

[kevinmehall]

• The state value is generated on initialization and re-used for all requests, so a potential attacker can obtain the value. It should be unique per-request and un-guessable.
• The callback does not verify the state passed back from GitHub.

[kevinmehall]

See http://www.twobotechnologies.com/blog/2014/02/importance-of-state-in-oauth2.html for how state is used to prevent CSRF.