title: Why does new Facebook Javascript SDK not violate the "same origin policy"?
body: <p>The new Facebook Javascript SDK can let any website login as a Facebook user and fetch data of a user...</p>
  
  <p>So it will be, www.example.com including some Javascript from Facebook, but as I recall, that script is considered to be of the origin of www.example.com and cannot fetch data from facebook.com, because it is a violation of the "same origin policy".  Isn't that correct?  If so, how does the script fetch data?</p>