Technically, yes, both of those should be enabled. We're still actually a little unsure what they're for, as we notify Facebook (through our calls) that those are the settings we want to use.. so really, it doesn't seem to make a difference whether or not they are enabled.
Honestly, we sort of think it's a way for Facebook to track how many user's/apps have migrated.
Certainly, test with any changes you make. We'll likely be updating our configuration guide to have a "Recommended migration settings" soon, but haven't found it necessary yet.
Thanks,
Alex
OAuth 2.0 Settings
