private String createRandomString(final int length) {
        final SecureRandom secureRandom = new SecureRandom();
        final byte[] bytes = new byte[length];
        secureRandom.nextBytes(bytes);
        return Base64.getUrlEncoder().encodeToString(bytes);
    }
A 'state' is a single use, cryptographically random string,
and it's use here is to prevent replay attacks.
<p>
State is used in the authentication flow - the hash is included in the original AuthenticationRequest
that Stroom makes to the Authentication Service. When Stroom is subsequently called the state is provided in the
URL to allow verification that the return request was expected.
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/AuthenticationStateCache.java