As I understand it, this is the basic process for new Facebook iframe canvas apps using the OAuth2 API in a nutshell:
Facebook has removed the feature of refresh the access token on the "behalf of" mode. The best and easy way is to redirect the user to facebook login page to re-oauth the app. Find facbook doc here