Add documentation about state and nonce handling

[lilioid]

Correctly handling state can be difficult and often causes confusion in developers (See this StackOverflow).
To aid our users, we should add documentation that explicitly describes how one should use state and nonce in the authorization code flow.