fail! if there is no 'code' parameter or 'fbsr_' cookie in the callback.

Includes tests for #signed_request.