if (req.query.state !== req.session.state) {
    res.send(JSON.stringify({ result: "error", error: "states mismatch" }))
    return
  }