Under the covers of OAuth 2.0 at Facebook