'state' parameter has to be at the end of the auth URL, last element in $options array

[CaffeineLab]

I hacked a quick fix, but there may be a better way.

I had to move the state parameter to the end of the authurl in order for it to return a token and not fail when checking against the session saved state. The following line was failing:

// Check given state against previously stored one to mitigate CSRF attack
} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {

In the base League code: AbstractProvider.getAuthorizationParameters()
my solution was to just rebuild the options array in the right order:

    if (isset($options['state'])) {
        $v = $options['state'];
        unset($options['state']);
        $options['state'] = $v;
    }

and then things came together.