Changed from sessions to JWT and I can almost log in to facebook. Fuck CORS :(