made SSO more optional to be backwards compatible