Opaque value forwarded unchanged as the OAuth2 state parameter on the
initial OAuth grant redirect, letting you round-trip per-user context to
your registered OAuth redirect_uri. Treat it as untrusted since it
travels through the end user's browser: sign it or use it as a lookup key
rather than trusting a raw value, and keep it short. Does not change
return_url behavior.