I'm trying to build a [canvas iframe application for Facebook](http://developers.facebook.com/docs/guides/canvas/). The app needs to do a couple of things:

1. Within Facebook display a leaderboard comparing you to your friends
2. Post messages to your wall

Facebook recommend building all new apps as iframe apps, hence using this API.
 I've downloaded the PHP SDK and installed the example as my app. 

I'm confused as to why the example.php presents a login button to a user - isn't the idea that the current user is already logged into Facebook? 

My current solution redirects the user to <http://graph.facebook.com/oauth/authorize> for authorisation, then grabs the OAuth token (for posting messages later) and heads back to an application page within the Facebook canvas. 

Is this really the only way to get the current Facebook user associated with my app, and to get permissions for posting messages later?