Harden OAuth login

Replaces JSON-encoded state parameter with server-side cache and random single-use tokens to prevent OAuth state injection attacks.