Best way to authorize more users on my app

The account_id returned by /oauth2/token is the account ID of the Dropbox account that was signed in and authorized the app, resulting in the authorization code that was used. Dropbox can't attest to the ID of the user in your app that was signed in to your app at the time. You'll need to manage that in your app's session code. 

Also, the state and code values are getting returned as expected for me. I just tried this /oauth2/authorize URL (using a redirect URI hosted on Dropbox itself as an example):

https://www.dropbox.com/oauth2/authorize?client_id=aa0sxbl9gon603m&response_type=code&force_reapprove=true&state=some_state_data&redirect_uri=https://www.dropbox.com/1/oauth2/redirect_receiver

Upon authorizing the app, it redirected me to the redirect URL:

https://www.dropbox.com/1/oauth2/redirect_receiver?state=some_state_data&code=Zu9U1XOZl8QAAAAAAAOJU6PUFC6TQK4AwnoQXp8eN08

That contains the expected state value, as well as an authorization code.

If something isn't working as expected, please share the steps/code to reproduce the issue, and the error or unexpected output.

You can use ?client_id=someid&state={base_encode('user_id')}, just put user_id, or some unique value to the state query param, and Dropbox will return you response as {code: "Some Code", state: 2}, where 2 - is User ID, as an example