According to the docs, Facebook is supposed to send both fb_sig_canvas_user and fb_sig_friends for a canvas application. Sadly, I only get fb_sig_canvas_user and NOT fb_sig_friends. Is there anything I have to do to get this parameter?
Or is there any other way to retrieve the friends of the visiting (not-yet-authorized) user, without the need of a session key (API throws exception with message "Requires user session" if no such key is present)?
And yes, _fb_fromhash is present in the request (when coming to the canvas app. from a user's application tab).
It makes no difference if the accounts being friends to each other are test accounts or normal Facebook accounts.