I imagine you just "replay" the issued/signed JWT to Facebook, so you can act like that user.