title: AWS Cognito & Grafana 'login.OAuthLogin(missing saved state)' and can't login as any other
body: <p>I'm developing a Cloudformation template to create a Cognito User Pool and then configure Grafana 6.0.2 with the entries to use that pool for Oauth sign-up and login.  It works partly now, but I have two bad behaviours (and maybe others I don't know about yet).</p>
  
  <p>1) After creating a new account, even in an Incognito browser window, I receive this error: 'login.OAuthLogin(missing saved state)'.</p>
  
  <p>2) If I return to the Grafana home page, and select 'Oauth login', I'm immediately logged in as that new user, with no chance to provide another user name.</p>
  
  <p>I created a Cognito User Pool manually, and have had that work properly.  I've attempted to re-create that in CloudFormation.</p>
  
  <p>Python snipped from my Cloudformation template to configure/create the Cognito User Pool &amp; Client:</p>
  
  <pre class="lang-py prettyprint-override"><code>  CreateUserPoolAndClientFunction: 
      Type: AWS::Lambda::Function
      Properties: 
        Handler: index.handler
        Role: !GetAtt LambdaExecutionRole.Arn
        Runtime: python3.6
        Timeout: 60
        Code: 
          ZipFile: |
            import boto3
            import cfnresponse
            def handler(event, context):
                responseData = {}
                print (str(event)) 
                try: 
                    if event['RequestType'] == 'Create':
                        Environment = event['ResourceProperties']['Environment']
                        BaseUrl = event['ResourceProperties']['BaseUrl']                          
                        client = boto3.client('cognito-idp') 
                        response = client.create_user_pool(
                            PoolName=Environment+'-userpool',
                            AutoVerifiedAttributes=['email'],
                            Schema=[
                                {
                                    'Name': 'email',
                                    'Required': True
                                }
                            ]
                        )
                        CreatedUserPoolId = response['UserPool']['Id']
                        response = client.create_user_pool_client(
                            UserPoolId=CreatedUserPoolId,
                            GenerateSecret=True,
                            ClientName=Environment + '-client',
                            ReadAttributes=[
                                'address', 'birthdate', 'email', 'email_verified', 'family_name', 'gender', 'given_name', 'locale', 'middle_name', 'name', 'nickname', 'phone_number', 'phone_number_verified', 'picture', 'preferred_username', 'profile', 'updated_at', 'website', 'zoneinfo'
                            ],
                            WriteAttributes=[
                                'address', 'birthdate', 'email', 'family_name', 'gender', 'given_name', 'locale', 'middle_name', 'name', 'nickname', 'phone_number', 'picture', 'preferred_username', 'profile', 'updated_at', 'website', 'zoneinfo'
                            ],
                            SupportedIdentityProviders=['COGNITO'],
                            CallbackURLs=['https://' + BaseUrl + '','https://' + BaseUrl + '/login','https://' + BaseUrl + '/login/generic_oauth'],
                            LogoutURLs=['https://' + BaseUrl + '/login','https://' + BaseUrl + '/logout'],
                            AllowedOAuthFlows=['implicit','code'],
                            AllowedOAuthScopes=['email','openid','profile'],
                            AllowedOAuthFlowsUserPoolClient=True
                        )
                        CreatedClientId = response['UserPoolClient']['ClientId']
                        CreatedClientSecret = response['UserPoolClient']['ClientSecret']
                        response = client.create_user_pool_domain(
                            Domain = str(CreatedClientId),
                            UserPoolId = CreatedUserPoolId
                        )
                        responseData['UserPoolId'] = CreatedUserPoolId
                        responseData['ClientId'] = CreatedClientId
                        responseData['ClientSecret'] = CreatedClientSecret
                        print("SUCCESS, ResponseData=" + str(responseData))
                        cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID")
                    else:
                        print("SUCCESS - operation not Create, ResponseData=" + str(responseData))
                        cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID")
                except Exception as e:
                    responseData['Error'] = str(e)
                    cfnresponse.send(event, context, cfnresponse.FAILED, responseData, "CustomResourcePhysicalID") 
                    print("FAILED ERROR: " + responseData['Error'])
  
  </code></pre>
  
  <p>Generic Oauth section from my Grafana ini file:</p>
  
  <pre><code>[auth.generic_oauth]
  enabled = true
  name = OAuth
  allow_sign_up = true
  client_id = 6ghk6ekcdb7um021jcu5prdq6d
  client_secret = 1090coldi5hba8ha9c52pq4f09hi2fm0mu5rqua7raaf9oqbq58
  ;scopes = user:email,read:org
  scopes = openid profile email
  auth_url = https://6ghk6ekcdb7um021jcu5prdq6d.auth.ap-southeast-2.amazoncognito.com/oauth2/authorize
  token_url = https://6ghk6ekcdb7um021jcu5prdq6d.auth.ap-southeast-2.amazoncognito.com/oauth2/token
  api_url = https://6ghk6ekcdb7um021jcu5prdq6d.auth.ap-southeast-2.amazoncognito.com/oauth2/userInfo
  </code></pre>
  
  <p>The 'BaseUrl' passed into the Cloudformation template will be something like 'grafana.oursite.com', and is a domain managed by AWS providing HTTPS.  The 'client_id' used in the Grafana ini file is the Cognito User Pool ID, and Cognito uses that for the Oauth URLs (AFAIK).</p>
  
  <p>Speculation can be helpful, but please say whether you know or are speculating - I'm doing this for a client and I'm on a deadline.  I'm not very knowledgeable on any of this, so feel free to say more rather than less.</p>
  
  <p>Thanks.</p>