The issue with cannot retrieve 'state' from undefined was related to my Rules after all.
We had special rules which were querying the request for a state and during signup with the api, the states parent object was undefined, hence the exeption.
This exception in one rule caused all subsequent rules to fail.
When a call to Authenticate is made, it had a state in it, but it also bumped the login count up to 2 (which meant that some of our other rules escaped early).
So in essence, triple check your rules! (facepalm)