Send appsecret_proof on FacebookProvider getUserByToken method.

[elozoya]

This change makes better secured Server API calls.

There is a Facebook App setting named "Require App Secret".
When this setting is enabled every API call has to include a parameter called "appsecret_proof".
Facebook documentation recommends to enable this settings so that if a user's access token is stolen by a malicious software, every API call without an appsecret_proof will fail.

The app secret proof is a sha256 hash of your access token, using the app secret as the key. Here's what the call looks like in PHP:

$appsecret_proof= hash_hmac('sha256', $access_token, $app_secret); 

Facebook Docs

• Verifying Graph API Calls with appsecret_proof: https://developers.facebook.com/docs/graph-api/securing-requests#appsecret_proof
• Login Security: https://developers.facebook.com/docs/facebook-login/security

[taylorotwell]

I need a description of what this actually does, etc.

[elozoya]

I added a description.

[SammyK]

👍 All good! :)

[elozoya]

Yeaaah! my first pull request to an OpenSource project.
Thanks!

[SammyK]

Congrats @emmanuellozoya! :)