I experienced the same thing, but I think this is not a mistake, but a confusing one.
Facebook places a cookie in a mobile safari that refers to a valid session or, possibly, an access token. If you log out of Facebook, it clears the access token and all cookies of the web browser that are not used in mobile safari. In fact, you cannot do this by code. Now, if you return and the mobile safari opens, there is still a valid session and you are logged in again without entering credentials.
You can specify an error to see if Facebook can invalidate the access token server side.
source share