Added a route that authenticates a player from facebook

I swear this used to exist but it got lost somewhere along the way. Using this route the client can create a player and associate it with a facebook user, and authenticate against a previously associated facebook user.
I'm a brilliant genius who makes a last second change and then doesn't rerun tests
Mainly I was missing a couple access-control-origin headers, sigh
If you run GET /players without search args it should return all of them