webapp gets user info from api server, not directly from fb