protected String getUserAccessToken()
  {
    // first, consider a signed request if it's supplied.
    // if there is a signed request, then it alone determines
    // the access token.
    String code;
    String access_token;
    JSONObject signed_request = getSignedRequest();
    if (signed_request != null)
    {
      // apps.facebook.com hands the access_token in the signed_request
      try
      {
        if (signed_request.has("oauth_token"))
        {
          access_token = signed_request.getString("oauth_token");

          setPersistentData("access_token", access_token);
          return access_token;
        }
      } catch (JSONException e)
      {
        // Do Nothing
      }
      try
      {
        // the JS SDK puts a code in with the redirect_uri of ''
        if (signed_request.has("code"))
        {
          code = signed_request.getString("code");
          access_token = getAccessTokenFromCode(code, "");
          if (access_token != null)
          {
            setPersistentData("code", code);
            setPersistentData("access_token", access_token);
            return access_token;
          }
        }
      } catch (JSONException e)
      {
        // Do Nothing
      }
      // signed request states there's no access token, so anything
      // stored should be cleared.
      clearAllPersistentData();
      return null;
      // respect the signed request's data, even
      // if there's an authorization code or something else
    }

    code = getCode();
    if (code != null && code != getPersistentData("code"))
    {
      access_token = getAccessTokenFromCode(code);
      if (access_token != null)
      {
        setPersistentData("code", code);
        setPersistentData("access_token", access_token);
        return access_token;
      }

      // code was bogus, so everything based on it should be invalidated.
      clearAllPersistentData();
      return null;
    }

    // as a fallback, just return whatever is in the persistent
    // store, knowing nothing explicit (signed request, authorization
    // code, etc.) was present to shadow it (or we saw a code in $_REQUEST,
    // but it's the same as what's in the persistent store)
    return getPersistentData("access_token");

  }