downgrading the version of  oauminauth-facebook

Omniauth-oauth2 causes the CSRF detected error because something is
redirecting to the callback URL twice in a row. First time the "state"
value is there and your callback processes. Then immediately after,
something redirects to the callback again, but the second time, the
"state" value has been deleted from session and causes the error.

So I downgrading the version to 4.0.