To start, we'd recommend looking at our
Facebook for JomSocial
setup instructions.
As for your issues, the forbidden access page is likely from sh404SEF's security settings. I'd disable that for now while setting up and testing. You can re-enable it later, but may need to loosen some settings. A lot of back and forth communication between your site and Facebook can trigger that security as it thinks it's another site trying to 'flood' your site with too many requests.
For the redirect loop, also in sh404SEF, please go into the area where you set the configuration per component and change JFBConnect to 'skip'. That will prevent sh404SEF from altering our URLs, which can confuse Facebook with some of their requests to us.
If that doesn't help, please check and disable any JFBConnect Profile plugins you have enabled for extensions that you don't have installed. So, for example, don't enable the Community Builder Profile plugin if you don't have CB installed.
Let us know how that goes, but if you need anything else, just let us know.
Thanks,
Alex