Question not for the pull request (that's ok) but for the following as noted in the start of the block.
Shouldn't inside this block after nullifying the state, also nullify the persistent state?
When a new facebook object is initialized the state is read from persistent data. This is ok to check against CSRF. 
But when the check is done then the state is read again and fires up again a message. 
This happens also in this pull request, and in all previous commits since v3.0.0 or so. 

Example: 

`user` gets redirected to login controller, then form the login controller to facebook (state is set), then to user page. User hits back in the browser and goes to the login controller. State remains in the REQUEST and state is read from persistent (because was not nullified) and thus an invalid CSRF error. 

I would have cleared the persistent state but did not in doubt of what affect such action could have on the shared session since I have not quite indulged to it