I can't be sure if this is a bug or something in the design that wasn't well documented, but somewhere around version 1.1.6.3 the content filter configuration changed. The work around is to enable and configure "dual wan mode". Try that and see if it resolves the issue.
EDIT:
I also had someone just tell me that you should try to input the domain without the sub or root.
So instead of putting in www.facebook.com just put in facebook. leave off the www and com I would try that before you work on dual wan mode. If it does work using just facebook then you can try facebook.com and leave off the www. I have seen a simular problem with other content filters not wanting subdomains and if you must have a subdomain you may want to try http://www.facebook.com. Although I would do each step as a single test piece and then work your way up to the subdomain.
Cisco is currently donating money to the Haiti earthquake appeal for every rating so please consider rating all helpful posts.