final StateData stateDataInSession = removeStateFromSession(session, state);
            if (stateDataInSession != null) {
                return stateDataInSession;
            }
        }
        throw new SsoLoginException("could not validate state");
    }

    protected StateData removeStateFromSession(final HttpSession session, final String state) {
        @SuppressWarnings("unchecked")