Handling of `state` parameter in Authentication: Recommend usage for next minor version

[GeorgDangl]

Update the spec for the next minor version to say that usage of state parameter in clients is strongly recommended. Servers also need to support the parameter if it's present in the client request.

See also #41.

[ykulbak]

Closing this issue for 1.1; Leaving the discussion open for the next major version. See #41