While not a bad article, I wish more people would just use the fetch (node-fetch, isomorphic-fetch) interface... I know some may be slightly easier, but in general fetch is good enough, and you can always create your own "client" that will abstract it's use a bit.
Very cool... The rate limit shouldn't be an issue since it's from the unauthenticated client, which allows one request per minute. Combining with sessionStorage to only refresh if on the page for 3+ minutes could even be reasonable there.
Without an express patent grant, Facebook can still sue you for use. It'd be a dick move, but in a patent war, it would likely happen... just look at the technology patent wars in phone tech.