public AuthenticationState create(final String url,
                                      final boolean prompt) {
        final String stateId = createRandomString(20);
        final String nonce = createRandomString(20);

        final AuthenticationState state = new AuthenticationState(stateId, url, nonce, prompt);
        LOGGER.debug(() -> LogUtil.message("Creating {}", state));

        cache.put(stateId, state);
        return state;
    }
A 'state' is a single use, cryptographically random string,
and it's use here is to prevent replay attacks.
<p>
State is used in the authentication flow - the hash is included in the original AuthenticationRequest
that Stroom makes to the Authentication Service. When Stroom is subsequently called the state is provided in the
URL to allow verification that the return request was expected.
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/AuthenticationStateCache.java