Enabled app secret proof by default

The default behavior should be to send the app secret proof for better security out-of-the-box.

Tests will now pass if your test app has "App Secret Proof for Server API calls" enabled.

[This documentation](https://developers.facebook.com/docs/graph-api/securing-requests) states that:

> If you're using the official PHP SDK, the appsecret_proof parameter is automatically added.

This PR makes that a true statement.