State token removed from session before authorization is complete

Since #2923213: Use session manager instead of accessing $_SESSION directly connecting an account on the Connected accounts page (/user/1/connected-accounts) no longer works and results in an access denied page on multilingual websites.

This page results in an access denied page since the first time /user/1/connected-accounts is visited and checked if the user has access to this page. Then the user will redirect to en/user/1/connected-accounts (probably because I have the URL detection method enabled) and access is checked again.

  public function access(): AccessResultInterface {
    // Confirm anti-forgery state token. This round-trip verification helps to
    // ensure that the user, not a malicious script, is making the request.
    $request = $this->requestStack->getCurrentRequest();
    $state_token = $request->get('state');
    if ($state_token && $this->stateToken->confirm($state_token)) {
      return AccessResult::allowed();
    }
    return AccessResult::forbidden();
  }

In the access method the state value is retrieved and removed from the session. So the second time, the value is retrieved again from the session, but is no longer available, which will result in an access denied error.