When logged in with Facebook, profile pic editor explains it is using the user's Facebook profile picture.
Anti-forgery check rejects facebook login requests over 10 minutes old.
Fixed handling of CloudFlare redirected traffic - now shows user's correct IP in session cookie.