code: func fromState(r *http.Request) (br blob.Ref, xsrfToken string, err error) {
  	params := strings.Split(r.FormValue("state"), ":")
  	if len(params) != 2 {
  		return br, "", fmt.Errorf("Invalid format for state parameter: %q, wanted blobRef:xsrfToken", r.FormValue("state"))
  	}
  	br, ok := blob.Parse(params[0])
  	if !ok {
  		return br, "", fmt.Errorf("Invalid blobRef in state parameter: %q", params[0])
  	}
  	token, err := hex.DecodeString(params[1])
  	if err != nil {
  		return br, "", fmt.Errorf("can't decode hex xsrftoken %q: %v", params[1], err)
  	}
  	return br, string(token), nil
  }
docs: // fromState parses the oauth state parameter from r to extract the blobRef of the
  // instance configuration and the xsrftoken that were stored during serveSetup.