allowed for facebook auth