Validate state before ID Token request

[ricklambrechts]

There was always an ID Token request to the idP, before the state was checked.

I think it is better to perform the state check first to prevent flooding the idP with incorrect requests.

Neither the OAuth 2.0 documentation or the OpenID spec says something about checking the state before requesting the ID Token. Only that we should validate it and we do this so, that is not a problem.

Also added a test to check if the properties are set correctly on authenticate and if the code and session matches.
Needed to mock the getState for PHP 7.1, looks to me like something with the session state is not working great in PHP 7.1.

PS: If you want, I can create a seperate function for the state check with the unset state so that we reuse code instead of the same duplicated state check,

PS: for the sometimes failing invalid-bad-iat test, would it be an option to update the 301 value to 302 ? Or just rerun the action?

List of common tasks a pull request require complete

• Changelog entry is added or the pull request don't alter library's functionality