You are using the wrong flow and/or not handling the current authentication flow.
That flow is for desktop applications and you must parse the access token that is returned in the url thus the message,
SECURITY WARNING: Please treat the URL above as you would your password and do not share it with anyone.
Because the access token is given in the open.
See this page for mor information https://developers.facebook.com/docs/facebook-login/login-flow-for-web-no-jssdk/