Thrown by resume when the redirect could not be validated or the authorization server returned an error.
the error code. For server errors this is the OAuth2 error code from the redirect; for a failed CSRF/state check it is the SDK-generated value "state_mismatch".
"state_mismatch"