Handle authentication code too

For applications which uses Graph API for server-side authentication.
Sending access token from client to server for server-side authentication causes a big security hole.
ref)
http://www.thread-safe.com/2012/04/followup-on-oauth-facebook-login.html
http://www.thread-safe.com/2012/01/problem-with-oauth-for-authentication.html