that's even better! the problem I had was that sso.js uses some values that are set by node somehow, and I didn't know how reliable they were. Essentially the trick here is to do "what sso.js does out of the box", PLUS showing/hiding the publish button. It might make sense to allow "additional" onlogin/onlogout handling, rather than handler overriding?