Support "state" parameter in OAuth

Summary:
Ref T1445. Ref T1536. Although we have separate CSRF protection and have never been vulnerable to OAuth hijacking, properly implementing the "state" parameter provides a little more certainty.

Before OAuth, we set a random value on the client, and pass its hash as the "state" parameter. Upon return, validate that (a) the user has a nonempty "phcid" cookie and (b) the OAuth endpoint passed back the correct state (the hash of that cookie).

Test Plan: Logged in with all OAuth providers, which all apparently support `state`.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran, arice

Maniphest Tasks: T1445, T1536

Differential Revision: https://secure.phabricator.com/D6179

src/applications/auth/controller/PhabricatorAuthController.php

@@ -39,7 +39,12 @@ abstract class PhabricatorAuthController extends PhabricatorController {
 
     $request->setCookie('phusr', $user->getUsername());
     $request->setCookie('phsid', $session_key);
+
+    // Clear the registration key.
     $request->clearCookie('phreg');
+
+    // Clear the client ID / OAuth state key.
+    $request->clearCookie('phcid');
   }
 
   protected function buildLoginValidateResponse(PhabricatorUser $user) {