Fb's login data send by client is validate using signedRequest and appSecretToken (to make sure it was created by Fb) before user is logIn and session created.