Store OAuth state server-side instead

Google OAuth hardening with server-side state storage instead of JSON encoding.