Made it so oauth callbacks try to get user by fb_id (oauth_id) for security reasons (i.e. if going by email or username, someone could login as someone else