Is this robust? I.e. will the access token always be immediately followed by expires? If the facebook API guarantees that, then I guess this is okay. I'd recommend taking a look [at this](http://nodejs.org/api/querystring.html) though.