I am confident my application is coded correctly (at least mostly), as it works about 98% of the time. However, about 2% of the time, I get what appears to be a valid auth toke
Is it possible that a person is shown the permissions page (on Facebook) and rejects it, so the user is then redirected back to your website, but with the Oauth error - which you need to handle.
Basically, I want to log in via Facebook, but I don't accept their conditions (eg. you might be asking for too many things). Thus I'll reject the login, and the source website (you) needs to handle the refusal.