I too am having this problem although I have the cookie parameter set in my FB.init function. Using the Chrome Dev Tools I can see that a cookie has been created by the JS SDK, but the auth.login event fires on every page load regardless.
I'm redirecting to url.com?login when PHP kicks in to login the user into my application, or create a new account if it doesn't exist. After the login completes, PHP redirects to url.com again. At the moment this is causing an endless loop between the auth.login event firing and PHP redirecting back to the page.
At the moment I'm doing some checks in the JS to see if PHP has a logged in user or not before doing the redirect, but from reading the documentation, I shouldn't have to do this.
Has anyone else experienced this?