Facebook API会话难题

我有一个允许用户使用Facebook API登录的页面。但问题当然是当用户更改页面时,需要重新授权登录。

所以在我的主页上

$facebook = new Facebook(array(
    'appId'  => 'xxx',
    'secret' => 'xxxxxx',
    'cookie' => false,
));

$session = $facebook->getSession();

if ($session) {
    try {
        $uid = $facebook->getUser();
        $me = $facebook->api('/me');

        $_SESSION['fb_session'] = $me;
        $_SESSION['fb_session']['loginUrl'] = $facebook->getLoginUrl();
        $_SESSION['fb_session']['logoutUrl'] = $facebook->getLogoutUrl();
        $_SESSION['fb_session'] = array_merge($_SESSION['fb_session'], $session);
    } 

    catch (FacebookApiException $e) {
        error_log($e);
        unset($_SESSION['fb_session']);
    }
}

if ($_SESSION['fb_session']) {
    $x = $facebook->api("/{$_SESSION['fb_session']['id']}");
    print "<img src='https://graph.facebook.com/{$x['id']}/picture' />";                        
    print "<a href='facebook_logout.php'></a>";
} 
else {

    $loginUrl = $facebook->getLoginUrl();
    print "<a href='{$facebook->getLoginUrl()}'>Login to Post Comment</a>";
}

还有我的 facebook_logout.php 看起来像:

header("location:" . $_SESSION['fb_session']['logoutUrl']);
unset($_SESSION['fb_session']);

现在的问题是,我已经在第一次验证用户身份时设置了会话。但如果他改变了自己的形象怎么办。或者在他的API中不允许我的网站。

我已经用我的个人资料测试过了。如果我允许的话,一切都会好的。但是,当我从隐私设置中删除应用程序时,我仍然可以看到我的图片和名称等。

以下是输出到 fb_session

[id] => id
[name] => Shahmir Javaid
[first_name] => Shahmir
[last_name] => Javaid
[link] => http://www.facebook.com/shahmirj
[about] => I was Born a n00b, I am still a n00b and il never be not a n00b.
[gender] => male
[locale] => en_GB
[verified] => 1
[updated_time] => 2010-11-22T15:45:22+0000
[loginUrl] => https://
[logoutUrl] => https://
[session_key] => xxx
[uid] => xxx
[expires] => 1290448800
[secret] => xxx
[access_token] => xxx
[sig] => xxx

如何重新验证uid,以便我的到期时间返回,当然不会让用户再次登录?