code: protected function onStateMismatch()
      {
          $this->logger->warning(
              "OAuth2 response state mismatch: provider: {provider} from {addr}",
              array(
                  "provider" => get_class($this->provider),
                  "addr" => $_SERVER['REMOTE_ADDR']
              )
          );
          $this->session->remove("oauth2state");
          $this->session->addFlash("error", "Invalid OAuth response.");
          $this->picoAuth->redirectToLogin();
      }
docs: Logs invalid state in the OAuth 2.0 response