Skip :verify_authenticity_token
It won't be expected in SSO.
Add required heroku-nav-data cookie
Add app name to the session
Needed in the navigation JS.