auth: Properly filter SSO backends for staff