Run provider callbacks only once per request. Facebook expires the token after the first access, related issue:

http://stackoverflow.com/questions/11407216/dealing-with-oauth-2-0-facebook-gem-error-100-this-authorization-code-has-been