Omniauth facebook without devise

- Added omniauth and omniauth-facebook gem
- created config/initializers/omniauth.rb
- Created signuper app on facebook developer platform
- Added "http://localhost:3000" to signuper facebook app platform
- Inserted facebook JavascriptSDK into index page
- input facebook APP_ID and APP_SECRET in .env file
- .gitignore .env file
- using /auth/facebook to request authentiation
- using /auth/facebook/callback to callback to signuper
okay! good suggestion. Creating user and session this way really lightened up the the entire process of user authentication, it makes a lot of sense in term of user experience, IMO. There would be no error message to deal with, and no need to even touch the keyboard from the user's stand point, both login and registration, it's like a one click easy button. But I was kinda of wondering if this practice could have any security risk, since no password would be involved here; the entire burden of user authentication is basically shifted to facebook's shoulder.