Facebook - PHP - connection auth - SDK v3

<?php

    // https://github.com/facebook/php-sdk/
    require_once 'facebook-php-sdk/src/facebook.php';

    $app_id      = 'xxxxxxxxxxxxxxx';
    $app_secret  = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
    $baseUrl     = 'http://www.example.lab/facebook/connect.php';

    session_start();
    $code = $_REQUEST["code"];

    if(empty($code)) {
        $_SESSION['state'] = md5(uniqid(rand(), TRUE)); //CSRF protection
        $dialog_url = "http://www.facebook.com/dialog/oauth?"
                    . "client_id="      . $app_id
                    . "&redirect_uri="  . urlencode($baseUrl)
                    . "&state="         . $_SESSION['state']
                    . "&scope=email,user_birthday";

        header('location:' . $dialog_url);
        //echo("<script> top.location.href='" . $dialog_url . "'</script>");
    }

    if (isset($_SESSION['state']) && ($_SESSION['state'] === $_REQUEST['state'])) {
        $token_url = "https://graph.facebook.com/oauth/access_token?"
                   . "client_id="       . $app_id
                   . "&redirect_uri="   . urlencode($baseUrl)
                   . "&client_secret="  . $app_secret
                   . "&code="           . $code;

        $response  = file_get_contents($token_url);
        $params    = null;
        parse_str($response, $params);

        $graph_url = "https://graph.facebook.com/me?access_token=" . $params['access_token']
                   . '&fields=id,email,first_name,last_name,gender,birthday,picture';

        $user = json_decode(file_get_contents($graph_url));
        print '<img src='. $user->picture .' />';
        var_dump($user);

    } else {
        echo("The state does not match. You may be a victim of CSRF.");
    }