code: private StateData validateState(HttpSession session, String state) throws Exception {
          if (StringUtils.isNotEmpty(state)) {
              StateData stateDataInSession = removeStateFromSession(session, state);
              if (stateDataInSession != null) {
                  return stateDataInSession;
              }
          }
          throw new Exception(FAILED_TO_VALIDATE_MESSAGE + "could not validate state");
      }
docs: make sure that state is stored in the session,
  delete it from session - should be used only once
  
  @param session
  @param state
  @throws Exception