rolleb omniauth-facebook back to 1.4.0 to prevent csrf issue