"state" means something specific to OAuth2 and SAML so we don't want to confuse developers who are working on this. Also don't use "session" which could easily be confused with HTTP cookies.
When compiling the default templates into the source code, use string literals instead of escaped strings to reduce merge conflicts.
