If you use Twitch Oauth and then the user clicks register instead of login from Twitch login screen, it adds a } to the end of the state. This means that when you get redirected to your site, the state has an extra } and fails cross site checks. How do I get this bug raised?