check for req.body undefined if access_token is not defined then pull from querystring.  if access_token remained undefined then fail to avoid trip to facebook