Make getApplicationAccessToken public

For posting apprequests, we need to use the application access token
not the user one. It is easy to specify this in the parameters to api
call except that the method to retrieve it is protected. I can see no
obvious reason why.
Marked deprecated methods with @deprecated.
Constructor reuses $state local variable pulled from persistent storage.
added proxy support; fixed multiple chained proxies present in HTTP_X_FORWARDED_HOST which cause getHttpHost() to break api calls
fixed typos
updated cert bundle to use the current curl bundle
fix broken tests and remove some broken ones
bump version to 3.2.1
Use `empty()` for signed request value check
fix curl ssl cacert invalid file
Avoid trying to reuse spent authorization codes

Conflicts:
	readme.md
	src/base_facebook.php
clarified apache specific lookup for ssl & added ability to look for nginx values for ssl
Merge pull request #45 from favrik/master

Use `empty()` for signed request value check
Merge pull request #50 from evanadelman/master

SSL detection breaks in NGINX
Fixed a vulnerability with signed requests
Merge pull request #57 from kilotaras/vulnerability_bug

Fixed a vulnerability with signed requests
Fix bug in CSRF state persistence when using shared sessions.
BaseFacebook loads the stored state in its constructor. However, at
that point, the shared session ID has not yet been initialized, so
getPersistentData() will return data from the non-shared-session cookie. Since
initSharedSession() depends upon state initialized in
BaseFacebook::__construct, just re-initialized the stored
state in the shared session situation.

Added appropriate tests to check CSRF state persistence with and without shared sessions.
Add phpunit as a composer dependency, and ignore vendored files
Ensure signature comparison always takes the same amount of time to avoid Remote Timing Attacks.
Only require phpunit in development environment
Added the extra param: appsecret_proof to the oauth api calls