diff --git a/assets/js/controllers/authCtrl.js b/assets/js/controllers/authCtrl.js
index ec282af366..bbcfb7853b 100644
--- a/assets/js/controllers/authCtrl.js
+++ b/assets/js/controllers/authCtrl.js
@@ -6,93 +6,81 @@
 
 habitrpg.controller("AuthCtrl", ['$scope', '$rootScope', 'User', '$http', '$location', 'API_URL',
   function($scope, $rootScope, User, $http, $location, API_URL) {
-  var runAuth;
-  var showedFacebookMessage;
+    var runAuth;
+    var showedFacebookMessage;
 
-  $scope.useUUID = false;
-  $scope.toggleUUID = function() {
-    if (showedFacebookMessage === false) {
-      alert("Until we add Facebook, use your UUID and API Token to log in (found at https://habitrpg.com > Options > Settings).");
-      showedFacebookMessage = true;
-    }
-    $scope.useUUID = !$scope.useUUID;
-  };
-
-  $scope.logout = function() {
-    localStorage.clear();
-    window.location.href = '/logout';
-  };
-
-  runAuth = function(id, token) {
-    User.authenticate(id, token, function(err) {
-      window.location.href = '/';
-      //$rootScope.modals.login = false;
-    });
-  };
-
-  $scope.register = function() {
-    /*TODO highlight invalid inputs
-     we have this as a workaround for https://github.com/HabitRPG/habitrpg-mobile/issues/64
-     */
-    if ($scope.registrationForm.$invalid) {
-      return;
-    }
-    $http.post(API_URL + "/api/v1/register", $scope.registerVals).success(function(data, status, headers, config) {
-      runAuth(data.id, data.apiToken);
-    }).error(function(data, status, headers, config) {
-        if (status === 0) {
-          alert("Server not currently reachable, try again later");
-        } else if (!!data && !!data.err) {
-          alert(data.err);
-        } else {
-          alert("ERROR: " + status);
-        }
-      });
-  };
-
-  function errorAlert(data, status, headers, config) {
-    if (status === 0) {
-      alert("Server not currently reachable, try again later");
-    } else if (!!data && !!data.err) {
-      alert(data.err);
-    } else {
-      alert("ERROR: " + status);
-    }
-  }
-
-  $scope.auth = function() {
-    var data = {
-      username: $scope.loginUsername,
-      password: $scope.loginPassword
+    $scope.useUUID = false;
+    $scope.toggleUUID = function() {
+      if (showedFacebookMessage === false) {
+        alert("Until we add Facebook, use your UUID and API Token to log in (found at https://habitrpg.com > Options > Settings).");
+        showedFacebookMessage = true;
+      }
+      $scope.useUUID = !$scope.useUUID;
     };
-    if ($scope.useUUID) {
-      runAuth($scope.loginUsername, $scope.loginPassword);
-    } else {
-      $http.post(API_URL + "/api/v1/user/auth/local", data)
-        .success(function(data, status, headers, config) {
-          runAuth(data.id, data.token);
-        }).error(errorAlert);
+
+    $scope.logout = function() {
+      localStorage.clear();
+      window.location.href = '/logout';
+    };
+
+    runAuth = function(id, token) {
+      User.authenticate(id, token, function(err) {
+        window.location.href = '/';
+        //$rootScope.modals.login = false;
+      });
+    };
+
+    $scope.register = function() {
+      /*TODO highlight invalid inputs
+       we have this as a workaround for https://github.com/HabitRPG/habitrpg-mobile/issues/64
+       */
+      if ($scope.registrationForm.$invalid) {
+        return;
+      }
+      $http.post(API_URL + "/api/v1/register", $scope.registerVals).success(function(data, status, headers, config) {
+        runAuth(data.id, data.apiToken);
+      }).error(function(data, status, headers, config) {
+          if (status === 0) {
+            alert("Server not currently reachable, try again later");
+          } else if (!!data && !!data.err) {
+            alert(data.err);
+          } else {
+            alert("ERROR: " + status);
+          }
+        });
+    };
+
+    function errorAlert(data, status, headers, config) {
+      if (status === 0) {
+        alert("Server not currently reachable, try again later");
+      } else if (!!data && !!data.err) {
+        alert(data.err);
+      } else {
+        alert("ERROR: " + status);
+      }
     }
-  };
 
-  $scope.facebookAuth = function(){
-    $http.get('/auth/facebook')
-      .success(function(data){
-        runAuth(data.id, data.token);
-      }).error(errorAlert);
-  }
+    $scope.auth = function() {
+      var data = {
+        username: $scope.loginUsername,
+        password: $scope.loginPassword
+      };
+      if ($scope.useUUID) {
+        runAuth($scope.loginUsername, $scope.loginPassword);
+      } else {
+        $http.post(API_URL + "/api/v1/user/auth/local", data)
+          .success(function(data, status, headers, config) {
+            runAuth(data.id, data.token);
+          }).error(errorAlert);
+      }
+    };
 
-  if ($location.path() == '/facebook-callback') {
-    var search = $location.search();
-    if (search.err) return alert(search.err);
-    runAuth(search._id, search.apiToken);
-  }
-
-  $scope.playButtonClick = function(){
-    if (User.authenticated()) {
-      window.location.href = '/#/tasks';
-    } else {
-      $('#login-modal').modal('show');
+    $scope.playButtonClick = function(){
+      if (User.authenticated()) {
+        window.location.href = '/#/tasks';
+      } else {
+        $('#login-modal').modal('show');
+      }
     }
   }
-}]);
+]);
diff --git a/assets/js/controllers/rootCtrl.js b/assets/js/controllers/rootCtrl.js
index d45548792d..d73cdfe6c4 100644
--- a/assets/js/controllers/rootCtrl.js
+++ b/assets/js/controllers/rootCtrl.js
@@ -5,61 +5,62 @@
 
 habitrpg.controller("RootCtrl", ['$scope', '$rootScope', '$location', 'User', '$http',
   function($scope, $rootScope, $location, User, $http) {
-  $rootScope.modals = {};
-  $rootScope.User = User;
-  $rootScope.user = User.user;
-  $rootScope.settings = User.settings;
-  $rootScope.flash = {errors: [], warnings: []};
+    $rootScope.modals = {};
+    $rootScope.User = User;
+    $rootScope.user = User.user;
+    $rootScope.settings = User.settings;
+    $rootScope.flash = {errors: [], warnings: []};
 
-  $scope.safeApply = function(fn) {
-    var phase = this.$root.$$phase;
-    if(phase == '$apply' || phase == '$digest') {
-      if(fn && (typeof(fn) === 'function')) {
-        fn();
-      }
-    } else {
-      this.$apply(fn);
-    }
-  };
-
-  /*
-   FIXME this is dangerous, organize helpers.coffee better, so we can group them by which controller needs them,
-   and then simply _.defaults($scope, Helpers.user) kinda thing
-   */
-  _.defaults($rootScope, window.habitrpgShared.algos);
-  _.defaults($rootScope, window.habitrpgShared.helpers);
-
-  $rootScope.set = User.set;
-  $rootScope.authenticated = User.authenticated;
-
-  $rootScope.dismissAlert = function() {
-    $rootScope.modals.newStuff = false;
-    $rootScope.set('flags.newStuff',false);
-  }
-
-  $rootScope.notPorted = function(){
-    alert("This feature is not yet ported from the original site.");
-  }
-
-  $rootScope.showStripe = function() {
-      var disableAds = User.user.flags.ads == 'hide' ? '' : 'Disable Ads, ';
-      StripeCheckout.open({
-        key: window.env.STRIPE_PUB_KEY,
-        address: false,
-        amount: 500,
-        name: "Checkout",
-        description: "Buy 20 Gems, " + disableAds + "Support the Developers",
-        panelLabel: "Checkout",
-        token: function(data) {
-          $scope.$apply(function(){
-            $http.post("/api/v1/user/buy-gems", data)
-              .success(function() {
-                window.location.href = "/";
-              }).error(function(err) {
-                alert(err);
-              });
-          })
+    $scope.safeApply = function(fn) {
+      var phase = this.$root.$$phase;
+      if(phase == '$apply' || phase == '$digest') {
+        if(fn && (typeof(fn) === 'function')) {
+          fn();
         }
-      });
+      } else {
+        this.$apply(fn);
+      }
+    };
+
+    /*
+     FIXME this is dangerous, organize helpers.coffee better, so we can group them by which controller needs them,
+     and then simply _.defaults($scope, Helpers.user) kinda thing
+     */
+    _.defaults($rootScope, window.habitrpgShared.algos);
+    _.defaults($rootScope, window.habitrpgShared.helpers);
+
+    $rootScope.set = User.set;
+    $rootScope.authenticated = User.authenticated;
+
+    $rootScope.dismissAlert = function() {
+      $rootScope.modals.newStuff = false;
+      $rootScope.set('flags.newStuff',false);
+    }
+
+    $rootScope.notPorted = function(){
+      alert("This feature is not yet ported from the original site.");
+    }
+
+    $rootScope.showStripe = function() {
+        var disableAds = User.user.flags.ads == 'hide' ? '' : 'Disable Ads, ';
+        StripeCheckout.open({
+          key: window.env.STRIPE_PUB_KEY,
+          address: false,
+          amount: 500,
+          name: "Checkout",
+          description: "Buy 20 Gems, " + disableAds + "Support the Developers",
+          panelLabel: "Checkout",
+          token: function(data) {
+            $scope.$apply(function(){
+              $http.post("/api/v1/user/buy-gems", data)
+                .success(function() {
+                  window.location.href = "/";
+                }).error(function(err) {
+                  alert(err);
+                });
+            })
+          }
+        });
+    }
   }
-}]);
+]);
diff --git a/assets/js/services/userServices.js b/assets/js/services/userServices.js
index 1253fa6001..2fcd78f764 100644
--- a/assets/js/services/userServices.js
+++ b/assets/js/services/userServices.js
@@ -169,7 +169,7 @@ angular.module('userServices', []).
 
             //if settings were saved while fetch was in process reset the flag.
             settings.fetching = false;
-            //create and load if not
+        //create and load if not
         } else {
             localStorage.setItem(STORAGE_SETTINGS_ID, JSON.stringify(defaultSettings));
             _.extend(settings, defaultSettings);
@@ -177,7 +177,19 @@ angular.module('userServices', []).
 
         //If user does not have ApiID that forward him to settings.
         if (!settings.auth.apiId || !settings.auth.apiToken) {
-            //$location.path("/login");
+          //var search = $location.search(); // FIXME this should be working, but it's returning an empty object when at a root url /?_id=...
+          var search = $location.search(window.location.search.substring(1)).$$search; // so we use this fugly hack instead
+          if (search.err) return alert(search.err);
+          if (search._id && search.apiToken) {
+            userServices.authenticate(search._id, search.apiToken, function(){
+              window.location.href='/';
+            });
+          } else {
+            if (window.location.pathname.indexOf('/static') !== 0){
+              localStorage.clear();
+              window.location.href = '/logout';
+            }
+          }
         } else {
             userServices.authenticate(settings.auth.apiId, settings.auth.apiToken)
         }
diff --git a/src/controllers/auth.js b/src/controllers/auth.js
index 4db27d919d..68d99cc097 100644
--- a/src/controllers/auth.js
+++ b/src/controllers/auth.js
@@ -208,9 +208,10 @@ api.setupPassport = function(router) {
       User.findOne({'auth.facebook.id':req.user.id}, function(err, user){
         if (err || !user) {
           if (!err) err = "New Facebook registrations aren't yet supported, only existing Facebook users. Help us code this!";
-          return res.redirect('/#/facebook-callback?err=' + err);
+          return res.redirect('/static/front?err=' + err);
         }
-        res.redirect('/#/facebook-callback?_id='+user._id+'&apiToken='+user.apiToken);
+        req.session.userId = user._id;
+        res.redirect('/static/front?_id='+user._id+'&apiToken='+user.apiToken);
       })
 
     });