@cdman 
Shouldn't the sso_auth cookie referred by name, setting(:sso_cookie_name)?
More generally, why do we need that?