I'm surprised that Facebook supports them

(and yes, they really want Facebook password)
As of their policies, it should be disallowed to request password from user's
You must not include functionality that proxies, requests or collects Facebook usernames or passwords.
So what is going on ? Is that just some exception?