How will this be monetized? I can't imagine it being free in perpetuity if it catches on.
What about security? Passing Facebook user access tokens over http opens them up to being sniffed on the wire, which would allow anyone to impersonate a user of your app. Maybe ssl is supported, but all of the api documentation examples use http.