Removed URL encoding of SSO token, fixed token validity.