php - 通过 Facebook 登录（范围）-> 电子邮件不起作用

Question

我试图在我的网站上登录一些血统的 facebook，但我遇到了一个小问题。当我尝试登录时，Facebook 甚至不要求电子邮件许可，只要求我的位置。这是我的代码的主要部分：

$app_id = "XXXXXX";
$app_secret = "XXXXX";
$my_url = "XXXXXX";

$code = $_REQUEST["code"];
if(empty($code)) {

     $_SESSION['state'] = md5(uniqid(rand(), TRUE)); // CSRF protection
     $dialog_url = "https://www.facebook.com/dialog/oauth?client_id=" 
            . $app_id . "&redirect_uri=" . urlencode($my_url) . "&state="
            . $_SESSION['state']."&scope=publish_stream,user_location,email";
     echo("<script> top.location.href='" . $dialog_url . "'</script>");
}

if (!$_POST) {

    if($_SESSION['state'] && ($_SESSION['state'] === $_REQUEST['state'])) {

        $token_url = "https://graph.facebook.com/oauth/access_token?"
                . "client_id=" . $app_id . "&redirect_uri=" . urlencode($my_url)
                . "&client_secret=" . $app_secret . "&code=" . $code;

        $response = file_get_contents($token_url);
        $params = null;
        parse_str($response, $params);

        $_SESSION['access_token'] = $params['access_token'];
        $graph_url = "https://graph.facebook.com/me?access_token=" 
                . $params['access_token'];

        $user = json_decode(file_get_contents($graph_url));

    } else {
        echo("The state does not match. You may be a victim of CSRF.");
    }
}

问题出在哪里？