issue 1: when victims visits attacker's page, I relogin them in my facebook and load /fb/connect URL, which boils down to attaching my facebook to victim's webs

issue 1: when victims visits attacker's page, I relogin them in my facebook and load /fb/connect URL, which boils down to attaching my facebook to victim's website account = hijacking.