This will show you EXACTLY which forms you should test.
{
"error": {
"message": "Error validating access token: Sessions for the user are not allowed because the user is not a confirmed user.",
"type": "OAuthException",
"code": 190,
"error_subcode": 464,
"fbtrace_id": "ARcjxqtEiGAhP9ORp5uEjl6"
}
}