Doesn't hardcoding things like `FacebookTokenError` seem to run against the grain of having pluggable authentication? Should error handling be passed into the control of the provider?