title: Facebook canvas app "redirect_uri" breaks out of iframe after authorization & authentication
body: <p>I'm upgrading my existing FB apps, and going absolutely bonkers trying to get a simple PHP iframe canvas app to authorize and authenticate (as well as use SSL). Never looked through so many examples...</p>
  
  <p>Here's where I'm stuck: After the user authorizes the app, and the app authenticates the user (I am able to make a graph request with the token OK), the redirect_uri happens, and the whole page refreshes, leaving Facebook and thenjust shows me the contents of my "Canvas URL" page (with my server's domain), rather than iframed on Facebook.</p>
  
  <p>I currently have this as a crude two step process...</p>
  
  <p>Here's what my code looks like on the first page (index.php):</p>
  
  <pre><code>&lt;?php
  require('src/facebook.php');
  
  $app_id = '123456789';
  $app_secret = '1234secrets1234';
  $canvas_page = "https://apps.facebook.com/123456789/";
  $canvas_url = "https://myserver.com/apptest/";
  
  $code = $_REQUEST['code'];
  
  if(!$code){
  $display= 'page';
  $scope= 'manage_pages, offline_access, read_insights, publish_stream, user_about_me, user_likes, email'; 
  $redirect_url = 'https://myserver.com/apptest/step2.php';
  $oauth_url    = 'https://www.facebook.com/dialog/oauth?canvas=1&amp;client_id='.$app_id.'&amp;display='.$display.'&amp;redirect_uri='.urlencode($redirect_url).'&amp;scope='.$scope;
  $config = array('appId'  =&gt; $app_id,'secret' =&gt; $app_secret,'cookie' =&gt; true,'domain' =&gt; true);
  $facebook_client = new Facebook($config);
  
  echo "&lt;script type=\"text/javascript\"&gt;top.location.href = \"".$oauth_url."\";&lt;/script&gt;";
  }
  ?&gt;
  </code></pre>
  
  <p>and the second page (step2.php):</p>
  
  <pre><code>&lt;?php
  require('src/facebook.php');
  
  $app_id = '123456789';
  $app_secret = '1234secrets1234';
  $canvas_page = "https://apps.facebook.com/123456789/";
  $canvas_url = "https://myserver.com/apptest/";
  
  
  if($_REQUEST['code']){
  $code=$_REQUEST['code'];
  $redirect_url = 'https://myserver.com/apptest/step2.php';
  $link="https://graph.facebook.com/oauth/access_token?canvas=1&amp;client_id=".$app_id."&amp;redirect_uri=".urlencode($redirect_url)."&amp;client_secret=".$app_secret."&amp;code=".$code;
  $string = file_get_contents($link);
  $auth_token=substr($string, 13, 150);
  
  $graph_url = "https://graph.facebook.com/me?access_token=".$auth_token;
  $user = json_decode(file_get_contents($graph_url));
  echo("Hello " . $user-&gt;name);
  } 
  </code></pre>
  
  <p>Again, once the user has authorized the app, and the app has authenticated the user, the graph call works. </p>
  
  <p>Any ideas?</p>