Hm, the SSO abstraction is a bit broken here then, isn't it... can we make `.login_url` a method on all SSO objects and always do the render in this mixin?  Then it'll be consistent and we won't get renders from within the SSO object.