What if you're redirected to a different origin? Not a common use case, but it does occur when you e.g. have several services and select where to go in the sign-in form.

Ideally one should be able to pass structured state throughout, but all we have is `state` really.

Sure but the idea is that your content should be on the same origin after the redirect.