Passing returnTo value always generates same state in authorize request

[mhautala]

We are passing a returnTo value to the res.oidc.login function like in this example: https://github.com/auth0/express-openid-connect/blob/master/EXAMPLES.md#3-route-customization

Just realized that this means for all requests the state param passed in authorize request will be then identical. This seems very weird from a security perspective.