allow req.body to be undefined but fail if token not located in querystring

The commits checks to see if the req.body is defined.  If it is it attempts to retrieve access_token and refresh_token from the body.  If access and refresh tokens are still undefined then pull from querystring.  Finally, if access token is still undefined then fail to avoid trip to facebook with empty token.