I think I see the problem. In your master page, you need to set RequireLogin = true before the parent's OnInit event happens. That property tells the master page to go ahead and make sure the user has installed the app, and get a session for that user. The
purpose of the property is to allow you to have some pages that don't force the user to install the app, so they can at least see some pages of your app before they decide to authorize/install it.
I'd recommend some code like the following on your master page (assuming you want to set this property on every page):
protected override void OnInit(EventArgs e)
RequireLogin = true;
Also, I'm not sure that the CanvasCallbackURL is necessarily what you want. I believe that should actually be the root of your site (http://clickso.mydomain.co.uk/) so that if you have a relative URL to other parts of your site (eg. href="page2.aspx"),
Facebook can construct it by just appending the two. Otherwise, Facebook might try to redirect your users to something like http://clickso.mydomain.co.uk/main.aspx/page2.aspx.
Hope that helps.