Parameter limits disagree with Duo documentation

[AaronAtDuo]

Description

The code comments for the state parameter indicate the minimum length of state is 22 characters, but the Duo docs (https://duo.com/docs/oauthapi#authorization-request) indicate it's 16. Let's reconcile the two.

Expected Behavior

Anywhere the parameter limits (state and nonce primarily) are described, they agree with the Duo documentation.

Actual Behavior

The state parameter limits disagree.

Steps to Reproduce

N/A

Workarounds

N/A