Post 2FA: Exception Value: Session `oidc_state` does not match the OIDC callback state

Filing this one so we don't forget:

Traceback:

File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/exception.py" in inner
  41.             response = get_response(request)

File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py" in _legacy_get_response
  249.             response = self._get_response(request)

File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py" in _get_response
  187.                 response = self.process_exception_by_middleware(e, request)

File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py" in _get_response
  185.                 response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "/usr/local/lib/python2.7/dist-packages/django/views/generic/base.py" in view
  68.             return self.dispatch(request, *args, **kwargs)

File "/usr/local/lib/python2.7/dist-packages/django/views/generic/base.py" in dispatch
  88.         return handler(request, *args, **kwargs)

File "/usr/local/lib/python2.7/dist-packages/mozilla_django_oidc/views.py" in get
  86.                 raise SuspiciousOperation(msg)

Exception Type: SuspiciousOperation at /oidc/callback/
Exception Value: Session `oidc_state` does not match the OIDC callback state

Start at mozilla_django_oidc/views.py line 86 and trace the /oidc/callback/ flow after 2FA, focusing on the session oidc_state and callback state comparison shown in the traceback. Done means determining why they differ and preventing the reported SuspiciousOperation for a valid OIDC callback.