Make getApplicationAccessToken public

For posting apprequests, we need to use the application access token
not the user one. It is easy to specify this in the parameters to api
call except that the method to retrieve it is protected. I can see no
obvious reason why.
Marked deprecated methods with @deprecated.
Constructor reuses $state local variable pulled from persistent storage.
added proxy support; fixed multiple chained proxies present in HTTP_X_FORWARDED_HOST which cause getHttpHost() to break api calls
fixed typos
fix curl ssl cacert invalid file
Fix bug in CSRF state persistence when using shared sessions.
BaseFacebook loads the stored state in its constructor. However, at
that point, the shared session ID has not yet been initialized, so
getPersistentData() will return data from the non-shared-session cookie. Since
initSharedSession() depends upon state initialized in
BaseFacebook::__construct, just re-initialized the stored
state in the shared session situation.

Added appropriate tests to check CSRF state persistence with and without shared sessions.
Add phpunit as a composer dependency, and ignore vendored files
Ensure signature comparison always takes the same amount of time to avoid Remote Timing Attacks.
Only require phpunit in development environment
Removed duplicate multiline comment start
Use OS-specific directory separator instead of hard-coded forward slash

Fix issue with cURL on Windows machines when the local CA cert file 
is used. For some reason cURL refuses to use the CA cert bundle if 
forward-slashes are present in its path name.
added relative link to the example
added color to the snippets
added composer usage example
If appsecret_proof param is sent in code, do not override in sdk
Merge pull request #8 from dmnc/master

Make getApplicationAccessToken public
Merge pull request #10 from dharkness/deprecations

Add replacement method to @deprecated tags
Make getLoginStatusUrl use /dialog/oauth

To make this a drop in replacement for the old endpoint, we also need
support from the /dialog/oauth endpoint. Specifically, the current
endpoint, when using display=none, always return the response as part of
the fragment, while the PHP SDK needs the signed_request as a query
string argument.
Check isset before unset
Merge pull request #98 from stevenwoodson/master

Small fix to base_facebook.php