diff --git a/pkg/router/handler_callback.go b/pkg/router/handler_callback.go
index d4f2cca..dbee764 100644
--- a/pkg/router/handler_callback.go
+++ b/pkg/router/handler_callback.go
@@ -15,6 +15,9 @@ import (
 )
 
 func (h *Handler) Callback(w http.ResponseWriter, r *http.Request) {
+	// unconditionally clear login cookie
+	h.clearLoginCookies(w)
+
 	loginCookie, err := h.getLoginCookie(r)
 	if err != nil {
 		msg := "callback: fetching login cookie"
@@ -33,8 +36,10 @@ func (h *Handler) Callback(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if params.Get("state") != loginCookie.State {
-		h.Unauthorized(w, r, fmt.Errorf("callback: state parameter mismatch (possible csrf)"))
+	expectedState := loginCookie.State
+	actualState := params.Get("state")
+	if expectedState != actualState {
+		h.Unauthorized(w, r, fmt.Errorf("callback: state parameter mismatch (possible csrf): expected %s, got %s", expectedState, actualState))
 		return
 	}
 
@@ -81,7 +86,6 @@ func (h *Handler) Callback(w http.ResponseWriter, r *http.Request) {
 		log.Info("callback: successfully fetched loginstatus token")
 	}
 
-	h.clearLoginCookies(w)
 	logSuccessfulLogin(tokens, loginCookie.Referer)
 	http.Redirect(w, r, loginCookie.Referer, http.StatusTemporaryRedirect)
 }
diff --git a/pkg/router/middleware/logentry.go b/pkg/router/middleware/logentry.go
index 339e6f8..89948f4 100644
--- a/pkg/router/middleware/logentry.go
+++ b/pkg/router/middleware/logentry.go
@@ -123,6 +123,7 @@ func requestLogFields(r *http.Request) map[string]interface{} {
 	requestFields := map[string]interface{}{
 		"cookies":       requestCookies(r),
 		"protocol":      r.Proto,
+		"referer":       r.Referer(),
 		"requestMethod": r.Method,
 		"requestPath":   r.URL.Path,
 		"userAgent":     r.UserAgent(),