They could just encrypt the facebook ids in a way that allows the server to map the encrypted client id back to the canonical facebook id.