MDL-80080 session: Unset logintoken after use

lib/classes/session/manager.php

@@ -1272,7 +1272,7 @@ class manager {
      * @return boolean If the submitted token is valid.
      */
     public static function validate_login_token($token = false) {
-        global $CFG;
+        global $CFG, $SESSION;
 
         if (!empty($CFG->alternateloginurl) || !empty($CFG->disablelogintoken)) {
             // An external login page cannot generate the login token we need to protect CSRF on
@@ -1292,7 +1292,7 @@ class manager {
         $currenttoken = self::get_login_token();
 
         // We need to clean the login token so the old one is not valid again.
-        self::create_login_token();
+        unset($SESSION->logintoken);
 
         if ($currenttoken !== $token) {
             // Fail the login.