[Openid-specs-fapi] Issue #257: state is required for non-OpenID-Clients now, PCKE should be as well (openid/fapi)

[tlodderstedt]

New issue 257: state is required for non-OpenID-Clients now, PCKE should be as well
https://bitbucket.org/openid/fapi/issues/257/state-is-required-for-non-openid-clients

Torsten Lodderstedt:

state can be used to detect CSRF, not code injection

that’s the reason the Security BCP makes PCKE mandatory for any OAuth client

I therefore think we should add this requirement to FAPI R.