When you use OmniAuth to login to a web app through Facebook, these are the permissions the webapp has:
Access my basic information Includes name, profile pictu
If you are using devise (like me) the easiest solution is to have both 'devise' and 'omniauth-facebook' in your Gemfile. Then in your devise initializer you can just add:
config.omniauth :facebook, "app", "secret", :scope => "user_photos"
This does the trick pretty well. Adding the omniauth initializer with devise set-up