Grant more permissions than just read_stream to test user
Show email address and password for newly created test-user
Workaround for 'Invalid appsecret_proof provided in the API'

Applying this patch was a suggestion from stackoverflow from here:
http://stackoverflow.com/a/21043213/1495086

and it works.

Here's how I can apply the patch even though vendor directory isn't in
git:

patch vendor/facebook/php-sdk-v4/src/Facebook/FacebookRequest.php <0001-Workaround-for-Invalid-appsecret_proof-provided-in-t.patch