Facebook token passed from one user to the other

Steps to reproduce

Imagine:
Alice has a Facebook account, no account yet on your Drupal site
Bob has a Drupal account on your website, and no Facebook account

You need a test Facebook account for Alice, that has never logged in your Drupal site yet. Alternatively, to simulate new user, take your own Facebook account, and delete your site's app in Facebook App Settings, or edit them and remove permission for e-mail.

1. Log out from both Drupal and Facebook
2. Use Simple FB Connect to sign up, with Alice account
3. Deny permission for e-mail during the OAuth flow
4. Error message is displayed about missing e-mail permission
5. Login with Bob account

Actual

In his $_SESSION variable, Bob has the Facebook token from Alice, in $_SESSION['simple_fb_connect']['user_token']. This token necessarily has e-mail permission denied (because of error displayed in 4.), but may have any count of other scopes granted, depending on what scopes were requested.

Now, any code that checks presence of this session data and uses it will make Bob act as Alice on Facebook.

Expected

When Bob logs in, he has no simple_fb_connect session data.

Solution

In case of error during the Facebook login flow, simple_fb_connect must delete the session data.

Other possible way: implement hook_user_login() and unset there session data from Simple FB Connect when the login did not happen through Simple FB Connect.