There’s a bit of confusion concerning the base64 decoding of the signed request returned by Facebook. Their FAQ mentions you have to use base64 decoding for URLs specifically which handle the proper character substitution for URLs.
The other error has to do with the end padding that is omitted. If you do a simple JSON parse on these base64 encoded string without padding, you may end up finding yourself missing a “}” on the end.
For instructions on getting the proper JSON, see this.