Thanks for trying it. The only change I had made was the one I mentioned.
It's odd in that it works fine without the force fbml mode (in https) or with the fbml mode (in http).
Not sure what's different at that point - but it seems like somehow the app isn't getting the right user data.
Sorry, but this one will take more time to investigate.