SSO through direct iframe interaction