title: ValidateAntiForgeryToken blocking new login
body: <p>I have an identity server 4 implementation very simple and I'm using the <code>oidc-client</code> on my angular APP to carry on all the security management. In my auth service I have the following:</p>
  
  <pre><code>@Injectable()
  export class AuthService {
      private manager: UserManager;
      private user: User = null;
  
      constructor() {
          if (!environment.production) {
              Log.logger = console;
          }
          this.manager = new UserManager(getClientSettings());
          this.manager.getUser()
                      .then(user =&gt; {
                          this.user = user;
                      });
          this.manager.events.addUserSignedOut(() =&gt; {
              this.user = null;
              this.signOut();
          });
      }
  
      signOut(): Promise&lt;void&gt; {
          return this.manager.signoutRedirect()
                             .then(() =&gt; {
                                 this.manager.clearStaleState();
                             });
      }
  
      ...more
  }
  
  export function getClientSettings(): UserManagerSettings {
      return {
          authority: environment.authorityUrl,
          client_id: 'myclient',
          redirect_uri: `${environment.baseUrl}/auth-callback`,
          post_logout_redirect_uri: environment.baseUrl,
          response_type: 'id_token token',
          scope: 'openid profile myapi',
          filterProtocolClaims: true,
          loadUserInfo: true,
          automaticSilentRenew: true,
          revokeAccessTokenOnSignout : true,
          silent_redirect_uri: `${environment.baseUrl}/silent-renew-callback`,
      };
  }
  </code></pre>
  
  <p>Everything works like a charm so I can log in/out without any issues, the token renewal works as expected and so far so good. However I decided to implement a "custom" behavior when a user open the application in multiple tabs on the same browser and one of them logs out. Then the event UserSignedOut is triggered and I sign out the rest of the tabs that may be open. The problem I have is that when the user comes back in, the FIRST login attempt is performed correctly, however any subsequent login request from any other tab results in a 400 - BAD REQUEST (removing the Antiforgery token attribute from the login method in my IS4 it then works but I don't want to do so).</p>
  
  <p>If you did refresh the tab then you get logged in therefore to me it seems something wrong with the actual state itself?</p>
  
  <p>I'm not sure if I should invoke any other method in my AuthService prior logging out or whether I should re-implement the ValidateAntiForgeryToken with a custom behavior for this.</p>
  
  <p>Any help is much appreciated, thanks!</p>