Fix "state" parameter of error responses

[hafezdivandari]

According to RFC 6749 on error response of the implicit grant, the authorization server should add parameters to the fragment component of the redirection URI and the state parameter is required if it was present on the request.

There already 2 error responses that have redirect URI:

• Invalid_scope:
  • The error parameters were already on fragment component when using implicit grant as expected, but this error response doesn't include the state parameter when redirecting. This PR fixes this on both 'auth code' and 'implicit' grants.
  • Auth code grant:
    • before: http://example.com/callback?error=access_denied&error_description=...
    • after: http://example.com/callback?state=123&error=access_denied&error_description=...
  • Implicit grant:
    • before: http://example.com/callback#error=access_denied&error_description=...
    • after: http://example.com/callback#state=123&error=access_denied&error_description=...
• access_denied: This error response does include the state parameter when redirecting as expected, but when using implicit grant, the error's state parameter is on query string and other parameters were on fragment component. This PR fixes this.
  • Before: http://example.com/callback?state=123#error=access_denied&error_description=...
  • After: http://example.com/callback#state=123&error=access_denied&error_description=...

[Sephster]

Please can you provide some information about why you want to add this change? Thank you

[hafezdivandari]

I added description I hope it is clear enough.

[hafezdivandari]

Just merged master into this and resolved conflicts.