fix(facebook): move from passport-facebook to Facebook JS SDK. Better
security on FB login by validating accessToken. Create user from FB
profile if none exists, allows 3rd-party apps to. Fixes #4221