Fix state handling for shortcode
Fix state handling for shortcode

State generation, specifically cookie storage, needs to happen before
any output. The previous arch was ok for login page generation but
failed with a "headers already set" error if used in the shortcode.
This addresses the issue by storing state earlier and getting the
value later.

auth0/wp-auth0