It’s my own fault, really.
I’ve been beating my head against the wall trying to authenticate a Facebook app. I tried the sample code, and it didn’t seem to work. I dug in. I poked around. Nothing. Super frustrated. Why would they provide sample code and docs that didn’t work?
Oh wait. Right here. When they say that by October 2011, you need to have an HTTPS connection, they mean it. Sure, they let you set up the entire developer account without one, but that’s just to give you a false sense of progress.