I'm working on SDK v.4 but something seems wrong with Class FacebookRedirectLoginHelper method isValidRedirect.

the SDK code is

```
 protected function isValidRedirect()
  {
    return $this->getCode() && isset($_GET['state'])
        && $_GET['state'] == $this->state;
  }

```

While `$_GET['state']` is the parameter in the callback URL and `$this->state` is assigned by the function `random()` which generates a cryptographically secure pseudrandom number. 

Both $\_GET['state'] and $this->state; will never return true! 

It should be check $\_SESSION not $\_GET