don't force token response to be JSON, allow extra argument for authorize (fb), remove printouts