bu: omniauth, facebook strategy, permit user if exists