moved SSO stuff up a bit, and needs to use ac2 var