Given URL is not allowed by the Application configuration.: One or more of the given URLs is not allowed by the App\'s settings. It must match the Website URL or Canvas URL,
This is a basic breakdown for slow people like me, and I didn't see this mentioned before.
The "redirect uri" isn't the place where you're redirecting to, but where it's coming from.
Say you have your app at http://myFBapp.com listening to /auth/facebook, and after they log in, redirecting them to /UserLoginHooray. The "Valid OAuth redirect URIs" should read http://myFBapp.com/auth/facebook, not http://myFBapp/UserLoginHooray.
Explanation: HTTP Requests that have been redirected (302) include the original address in the header, so Facebook is merely putting a very basic layer of security on the request.