remove now redundant per-request state from signed_request flow (it will fail CSRF)