added proxy support; fixed multiple chained proxies present in HTTP_X_FORWARDED_HOST which cause getHttpHost() to break api calls
fixed typos
Fix bug in CSRF state persistence when using shared sessions.
BaseFacebook loads the stored state in its constructor. However, at
that point, the shared session ID has not yet been initialized, so
getPersistentData() will return data from the non-shared-session cookie. Since
initSharedSession() depends upon state initialized in
BaseFacebook::__construct, just re-initialized the stored
state in the shared session situation.

Added appropriate tests to check CSRF state persistence with and without shared sessions.
Ensure signature comparison always takes the same amount of time to avoid Remote Timing Attacks.
Use OS-specific directory separator instead of hard-coded forward slash

Fix issue with cURL on Windows machines when the local CA cert file 
is used. For some reason cURL refuses to use the CA cert bundle if 
forward-slashes are present in its path name.
If appsecret_proof param is sent in code, do not override in sdk
Make getLoginStatusUrl use /dialog/oauth

To make this a drop in replacement for the old endpoint, we also need
support from the /dialog/oauth endpoint. Specifically, the current
endpoint, when using display=none, always return the response as part of
the fragment, while the PHP SDK needs the signed_request as a query
string argument.
Merge pull request #59 from JohnnyGoods/master

Fix bug in CSRF state persistence when using shared sessions.
Merge pull request #94 from oyvindkinsey/master

Make getLoginStatusUrl use /dialog/oauth
Improved validation in parseSignedRequest.
Added validation and test for non-int error_code defaulting to 0.
Merge pull request #78 from alixandru/master

Use OS-specific directory separator instead of hard-coded forward slash
Merge pull request #106 from gfosco/error_code

Added validation and test for non-int error_code defaulting to 0.
Update .travis.yml
Don't convert CURLFile params to JSON

PHP 5.5 will throw deprecation warnings if users are uploading files with the previously documented `'source' => '@/foo/bar.jpg',` syntax.

The new approach is to use `'source' => new CurlFile('/foo/bar.jpg', 'image/jpeg'),`, which obviously avoids accidental uploads (or upload attempts) from user-provided content which starts with a `"@"` character.
and -> &&
Merge pull request #110 from philsturgeon/php55

Dont convert CURLFile: Take 2
Merge remote-tracking branch 'upstream/master'

Conflicts:
	src/base_facebook.php
    Added support for multiple chained proxies that append a comma and their hostnames to the previous X-Forwarded-Host header.
    If we have Client <---> Fwd Proxy1 (first.proxy) <---> Fwd Proxy2 (second.proxy )<---> Application (third.server), then we
    will have these values for a script executed on third.server::

    $_SERVER['HTTP_X_FORWARDED_HOST'] = 'first.proxy, second.proxy';
    $_SERVER['HTTP_HOST'] = 'third.server';

    If we use the raw value from $_SERVER['HTTP_X_FORWARDED_HOST'] for composing return URLs, we will generate invalid return URLs,
    in our case 'http://first.proxy, second.proxy/fb_oauth.php', and get a 'Oauth exception 191' or some other error message.

    If we properly process the X-Forwarded-Host value by taking the leftmost host, we will not get errors.
Add space to if statement.