Correct values for nonce and state in OpenID auth flow

Relevant bits from the spec:

http://www.imsglobal.org/spec/security/v1p0/#step-2-authentication-request

```
nonce
REQUIRED.
String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token.
```

```
state
RCOMMENDED as per [OPENID-CCORE].
Opaque value for the platform to maintain state between the
request and callback and provide Cross-Site Request Forgery (CSRF) mitigation.
```