update OmniAuth Facebook because of CSRF vulnerability

The CSRF added in omniauth-facebook version 1.4.1 should be considered broken. Because of the way it supports setting a per-request state parameter by storing it in the session, one can circumvent the automatic CSRF protection.

Versions before 1.4.1 did not have any CSRF protection. Even if this vulnerability does not affect them, downgrading is not a fix