It would be helpful to log the specific error code when displaying a login error template caused by the oauth2 callback, so that admins can easily inspect any errors that might be occurring (without e.g. expecting users to screenshot the error page and send it to tech support).
For that matter, it might also be useful in the login endpoint to log the value of oauth2_state, to aid further in debugging, but I'm not sure.