func HandleLogin(w http.ResponseWriter, r *http.Request) (err error) {
	session, err := cookieStore.Get(r, oauthSessionName)
	if err != nil {
		log.Printf("corrupted session %s -- generated new", err)
		err = nil
	}
	var tokenBytes [255]byte
	if _, err := rand.Read(tokenBytes[:]); err != nil {
		return AnnotateError(err, "Couldn't generate a session!", http.StatusInternalServerError)
	}
	state := hex.EncodeToString(tokenBytes[:])
	session.AddFlash(state, stateCallbackKey)
	if err = session.Save(r, w); err != nil {
		return
	}
	http.Redirect(w, r, oauth2Config.AuthCodeURL(state, claims), http.StatusTemporaryRedirect)
	return
}
HandleLogin is a Handler that redirects the user to Twitch for login, and provides the 'state'
parameter which protects against login CSRF.
package main
import (
	"context"
	"crypto/rand"
	"encoding/gob"
	"encoding/hex"
	"errors"
	"fmt"
	"log"
	"net/http"
	oidc "github.com/coreos/go-oidc"
	"github.com/gorilla/sessions"
	"golang.org/x/oauth2"
)
const (
	stateCallbackKey = "oauth-state-callback"
	oauthSessionName = "oauth-oidc-session"
	oauthTokenKey    = "oauth-token"
)
var (
	clientID = "<CLIENT_ID>"
	clientSecret = "<CLIENT_SECRET>"
	scopes       = []string{oidc.ScopeOpenID}
	claims       = oauth2.SetAuthURLParam("claims", `{"id_token":{"email":null}}`)
	redirectURL  = "http://localhost:7001/redirect"
	oauth2Config *oauth2.Config
	oidcIssuer   = "https://id.twitch.tv/oauth2"
	oidcVerifier *oidc.IDTokenVerifier
	cookieSecret = []byte("Please use a more sensible secret than this one")
	cookieStore  = sessions.NewCookieStore(cookieSecret)
)
func HandleRoot(w http.ResponseWriter, r *http.Request) (err error) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	w.WriteHeader(http.StatusOK)
	w.Write([]byte(`<html><body><a href="/login">Login using Twitch</a></body></html>`))
	return
}