This is in a Rack middleware and AFAIK this is too up (or down - depending on your POV) the chain to have access to SiteSettings. The condition I'm trying to express here is: "if there is no sso auth cookie but there is an active user" - in which case it should kill those values (which will result in a new, un-logged session being generated).