Not sure if this is best suited to Programmers, Server Fault or Stack Overflow. It\'s not, however, a question about developing for Facebook.
One of the advantages of using a custom domain is that it looks a lot more trustworthy. I've seen a good chunk of Windows malware that sets up a local proxy server; any web requests that go to 127.0.0.1 (and not on a test web server the user knows about) would look pretty suspicious, which I'm sure both Facebook and Spotify would like to avoid.