work around Facebook's non-conformance

Facebook uses URL-encoding instead of JSON for access token response bodies, and they use `expires` instead of `expires_in`. Fixes https://github.com/idan/oauthlib/issues/267.
I figured we could depend on the default behavior of the calling class, as described [above](https://github.com/idan/oauthlib/pull/268#issuecomment-55915122).