This clearly violates facebook's terms of service for third party authentication (i know this because i was working with a company that actually read the terms and decided not to use auth with facebook because of it).

Do they have a special deal with facebook or am i missing something here?