made sure /auth/facebook/callback... with res.cookie, and then res.redirect... is async, with cookie first