That cannot possibly be it, the last permission is just the "offline_access" field that was available to normal developers and I remember seeing used a lot. I refuse to believe this is what fb talks about when saying users gave permission.