using states not states is funny but I think someone will be confused. It would be more boring but something like 'fxa-csrf-state' would make the test easier to follow for someone new to the code. `</DebbieDowner>` 