API: add facebook auth route