Issue Summary

In the Bitbucket Data Center, there is an issue with the OAuth2.0 provider. When a user denies consent, the `state` parameter is missing in the callback. This violates RFC6749 section 4.1.2.1 and causes CSRF prevention and integration issues.

Steps to Reproduce

1. Setup Oauth2-based Application Link on Bitbucket DC
2. Initiate a Request from the OAuth Client App nd deny the Consent

Expected Results

The return callback reponse hsould also have the `state` parameter

Actual Results

It doesn't have the state parameter included when consent is denied; only the state is passed when the Consent is Approved or Allowed

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available