To Request permission and use the "user" token to begin querying, you can use a url like this:

https://graph.facebook.com/oauth/authorize?type=user_agent&client_id=&redirect_uri=&scope=email

You can pass any scope you want. I would suggest letting the user "pick" what scope they want in the authorize request. This allows them to test the fql they are using with different permissions to determine what they do/don't need to get specific data. The documentation from FB is not always that accurate I've found...

That url will redirect with an "auth token" for the user that should be valid for their current session.

There is another url out there somewhere that you can request the user token without doing the redirect dance, but I can't find it atm. If I run across it, I'll put it up here as well.

Feel free to contact me with any questions.