Reproduction instructions:

• Visit secure.phabricator.com while logged out from an iPhone.
• Click "Login with Facebook".

Actual behavior:

• Facebook redirects to m.facebook.com.
• This is not part of the form-action CSP.
• The very sketchy redirect-after-post CSP rule blocks the request.

"Solution":

• Add m.facebook.com to the form-action CSP.

In a perfect world:

• Browsers should drop this redirect-after-post CSP rule because it makes these workflows impossible to get right without enumerating all of the behaviors of Facebook/Google/etc/etc and updating every CSP-respecting client if they change.