Omniauth-facebook is hitting callback twice and failing - ruby-on-rails

Question

This problem has puzzled me for a few days, and I think I've finally narrowed it down. I'm using the Facebook JS SDK to do client side authentication:
FB.login(function(response) {
if (response.authResponse) {
var url = "/auth/facebook/callback?redirect=";
url += '&' + $.param({ signed_request: response.authResponse.signedRequest });
window.location = url;
}
}, { scope:'email,publish_stream,publish_actions' })
Note that I'm manually passing in the signedRequest. For some reason when I don't, I get an error that complains that there must be a 'code' parameter or a signed request (OmniAuth Strategies Facebook NoAuthorizationCodeError (must pass either a `code` parameter or a signed request (via `signed_request` parameter):). This is with omniauth-facebook gem version 1.4.0. If I use the latest of 1.4.1, I get the invalid_credentials issue that everyone else seems to be getting.
When I try to log in, something strange happens. I turned on my Chrome debugger, switched to the Network tab. I see two network requests, both GET to
https://www.MYHOST.com/auth/facebook/callback?redirect=&signed_request=BIGSTRINGHERE
However, interestingly the first request has a status of 301 and the second has a status of 302, and the next network request is to the /auth/failure callback. To make things more puzzling, this doesn't reproduce locally, only in production. Locally, it works and only does a single request, which has a http status of 302.
Also it's worth noting that after hitting the failure callback, it returns to my website homepage, which then triggers the autologin feature because it detects the user is a FB user and has an account on the site. This piece of code hits the same callback url and succeeds.
So my question is why is there a second request to the callback and how do I get rid of it to presumably get the login to work correctly? Bonus question is why do I have to manually pass along the signedRequest when tutorials don't seem to have to do this (e.g. RailsCast #360)?
A few notes to clarify and provide details:
I am using omniauth-facebook 1.4.0, omniauth 1.1.4, and omniauth-oauth 1.0.3
I am not using Devise. I also don't seem to be initializing the facebook omniauth more than once.
This issue only happens locally and not in production using the same Facebook app ID and secret. The login url is set to a production domain and I use some local configurations to get production domains to point locally.
The appID and secret are correct (the autologin works, and it works locally).
The Facebook app is not in sandbox mode.

Answer 1

Turns out the issue was that the callback that was redirected to was https. Since that page wasn't available in https, it redirected to http, resulting either in a loss of data or bad data. I failed to notice that the second request was http and not https. Enabling ssl for that callback action fixed the issue.