I am using Omniauth and forcing /auth/facebook to display in a popup (with JS). [Instead of a new window - which is much less user friendly]
The problem is: Omniauth
Actually, in the current version of omniauth-facebook, this is what works for me:
:authorize_params => { :display => 'popup' }