fix CSRF vulnerability (cherry-picked from 1-5-0-stable)

Conflicts:
	lib/omniauth/strategies/facebook.rb
	test/support/shared_examples.rb
	test/test.rb