It seems Facebook still supports some old style applications, and in some cases will pass account tokens in the clear, as part of a URL to advertisers and applications.

Having a token means people or applications can access and update Facebook on your behalf. And we know well how many dodgy applications are out there...

Another reason to always decline those invites to install silly applications and games on Facebook...

Read more on "Facebook Applications Accidentally Leaking Access to Third Parties".