facebook sdk upgrade

- explicit trust of x-forwarded headers
- secondary session ID for shared session environments
Bump to latest tagged FB PHP SDK

apache-2.2.25.tar.gz and php-5.3.27.tar.gz

Appears to address issues with updated PHP (5.3.27) and Apache
(2.2.25), recently seen in the new heroku-buildpack-php.
Switch to composer