Facebook app login / authorization entirely client-side