[michaeljx]

Yup that's the thing, Facebook doesn't do that. The token is the only thing needed, no validation on their half if it matches a client id