Peter,
Yes, if your site is unreachable 'publicly' so that a username/password or other restriction would be required to see the page with the comment box, then it is unreachable to Facebook. Once a few pages on your site with a comment box are publicly reachable, then even if you do have some registered user content, Facebook will remove that message. Until then though, it's something you just have to ignore.
The Canvas URL is for completely different features and not related to the Comment box.
Hope that helps explain,
Alex