There's an extraneous `&` in the URL: `/me?&appsecret_proof`
Should be:  `/me?appsecret_proof`

Don't worry about fixing, I've got a branch where I've corrected this.