first pass at sso token