Expose app_id and secret directly on req.facebook