code: public String computeAppSecretProof(final String url, final OAuth2AccessToken token, final FacebookConfiguration configuration) {
          try {
              Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
              SecretKeySpec secret_key = new SecretKeySpec(configuration.getSecret().getBytes(StandardCharsets.UTF_8), "HmacSHA256");
              sha256_HMAC.init(secret_key);
              String proof = org.apache.commons.codec.binary.Hex.encodeHexString(sha256_HMAC.doFinal(token.getAccessToken()
                  .getBytes(StandardCharsets.UTF_8)));
              final String computedUrl = CommonHelper.addParameter(url, APPSECRET_PARAMETER, proof);
              return computedUrl;
          } catch (final InvalidKeyException | NoSuchAlgorithmException e) {
              throw new TechnicalException("Unable to compute appsecret_proof", e);
          }
      }
docs: The code in this method is based on this blog post:
  https://www.sammyk.me/the-single-most-important-way-to-make-your-facebook-app-more-secure
  and this answer: https://stackoverflow.com/questions/7124735/hmac-sha256-algorithm-for-signature-calculation
  
  @param url the URL to which we're adding the proof
  @param token the application token we pass back and forth
  @param configuration the current configuration
  @return URL with the appsecret_proof parameter added