python - Passing a Facebook Oauth2 object while using Tornado -

i trying implement oauth manually on website being implemented using tornado. url (localhost/form) contains button when clicked brings facebook login , if login successful redirects same site token (localhost/form?code=xxx) collect token/code , begins taking requests facebook.

my issue upon redirecting localhost/form given code, appears reinitialize brand new oauth2session object not match token , receive request error. how should correctly pass oauth2session object or correctly reinitialize it? reinitialization causing error or else? current code not work is:

class formhandler (basehandler):  def get(self):         client_id =xxx         client_secret =xxx         authorization_base_url = 'https://www.facebook.com/dialog/oauth'         token_url = 'https://graph.facebook.com/oauth/access_token'          facebook = oauth2session(client_id, redirect_uri='http://localhost/form')         facebook = facebook_compliance_fix(facebook)         authorization_url, state = facebook.authorization_url(authorization_base_url)         self.write('<button id="facebookmanual" type="button">facebook manual</button><br><script> document.getelementbyid("facebookmanual").onclick = function () {location.href ="'+authorization_url+'";};</script>')          #check see if redirected code         authorization_code=self.get_argument("code", default=none, strip=false)         if authorization_code not none:             redirect_response='https://localhost/form/?code='+authorization_code             facebook.fetch_token(token_url, client_secret=client_secret, authorization_response=redirect_response)             r = facebook.get('https://graph.facebook.com/me?')             self.write('hello'+r.content)  #roughly how tornado set def make_app():  return application(    [     url('/', basehandler, { "var":"nothing" }, name="root"), # root! :)     url('/form', formhandler, { "var":"initialize this!" }, name = "forlorn"),    ], # settings:    debug = true, 

)

edit: friend advised me include error receiving. error oauthlib.oauth2.rfc6749.errors.mismatchingstateerror: (mismatching_state) csrf warning! state not equal in request , response. error:tornado.access:500 /form?code=xxx