I am using Omniauth and forcing /auth/facebook to display in a popup (with JS). [Instead of a new window - which is much less user friendly]
The problem is: Omniauth
If you're using this with Devise, simply edit your development.rb (and production.rb) to the following;
config.omniauth :facebook, FACEBOOK_API, FACEBOOK_SECRET, :display => 'popup'
Make sure you restart your rails server upon editing these files.