improve security on facebook callback