Minor Description
Previously this was hard-coded to use base64 encoding (and this should be retained as the default behaviour).
However, alternative implementations could:
a) use HMAC to encrypt, or
b) return a GUID as a token and hold the state server-side in some sort of "session cache"