JSF Login with Facebook (SocialAuth) and keeping S

I've been stuck on this issue for quite a while, and I've re-formulated my question a few times. I'll be explicit with this one, providing the implementation below:

index.xhtml, the short version.

...
<f:event listener="#{userBacking.pullUserInfo}" type="preRenderView" />

<h:commandLink action="#{userBacking.login()}"  value="Login"  rendered="#{!userBacking.isLoggedIn()}"/>
<h:commandLink action="#{userBacking.logout()}" value="Logout" rendered="#{userBacking.isLoggedIn()}" />

<h:outputText rendered="#{userBacking.isLoggedIn()}" value="#{userBacking.userProfile.fullName}" />
...

UserBacking.java

/**
 * 
 * @author ggrec
 *
 */
@ManagedBean
@SessionScoped
public class UserBacking implements Serializable
{

    // ==================== 2. Instance Fields ============================

    private static final long serialVersionUID = -2262690225818595135L;

    /**
     * This is static for now. In the future, Google (and others) may be implemented.
     */
    public static final String SOCIAL_PROVIDER_ID = "facebook"; //$NON-NLS-1$


    // ==================== 2. Instance Fields ============================

    private SocialAuthManager socialAuthManager;

    private Profile userProfile;


    // ==================== 6. Action Methods =============================

    public void login() throws Exception
    {
        final Properties props = System.getProperties();
        props.put("graph.facebook.com.consumer_key", FACEBOOK_APP_ID); //$NON-NLS-1$
        props.put("graph.facebook.com.consumer_secret", FACEBOOK_APP_SECRET); //$NON-NLS-1$
        props.put("graph.facebook.com.custom_permissions", "email"); //$NON-NLS-1$ //$NON-NLS-2$
        final SocialAuthConfig config = SocialAuthConfig.getDefault();
        config.load(props);

        socialAuthManager = new SocialAuthManager();
        socialAuthManager.setSocialAuthConfig(config);

        final String authenticationURL = socialAuthManager.getAuthenticationUrl(SOCIAL_PROVIDER_ID, successURL());

        ContextHelper.redirect(authenticationURL);
    }


    public void logout() throws Exception
    {
        socialAuthManager.disconnectProvider(SOCIAL_PROVIDER_ID);

        ContextHelper.invalidateSession();
    }

    /*
     * Should fill up the profile, if a redirect from Facebook appers. Uhhh....
     */
    public void pullUserInfo() throws Exception
    {
        if (userProfile == null && socialAuthManager != null)
        {
            final HttpServletRequest req = (HttpServletRequest) ContextHelper.ectx().getRequest();
            final Map<String, String> reqParam = SocialAuthUtil.getRequestParametersMap(req);

            final AuthProvider authProvider = socialAuthManager.connect(reqParam);

            userProfile = authProvider.getUserProfile();

            ContextHelper.redirect( ContextHelper.getContextPath() );
        }
    }


    // ==================== 7. Getters & Setters ======================

    public Profile getUserProfile()
    {
        return userProfile;
    }


    public boolean isLoggedIn()
    {
        return userProfile != null;
    }


    // ==================== 9. Convenience Methods ========================

    private static String successURL()
    {
        return IApplicationConstants.APP_PSEUDO_URL + ContextHelper.getContextPath();
    }

}

My story

Works fine if a Facebook session doesn't exist in the browser. If I'm already logged in, it seems that the socialAuthManager is NULL when a code in the request params appears.
I use index.xhtml for both login and callback.
The f:event fires pullUserInfo() each time the view renders, hoping that when the method fires, a code is provided in the request params. I am aware that this is all wrong.
Can this be done with a filter (i.e. when Facebook calls back with a code)?
I'm not the biggest JSF expert, so I might be missing some basic knowledge.

References

Mr James - Implement Facebook login in JSF using SocialAuth
How use SocialAuth with JSF to redirect?
This very pretty flowchart

The answer is pretty straightforward, and stupid at the same time.

Session is lost and created as new in every servlet request

I'm firing the login from http://devel-win8:1381/app/login, but the callback is found at http://dev-machine:1381/app/callback (this is a different implementation, with servlets, but it will work with the code in the question as well).

The browser creates different session for 'naked' host names.

Cheers.