SSO session work, and check what AuthnContext to auth with.
Validate SSO sessions.

Can't trust the cookie expiration time - must validate age of SSO
sessions on server side.
Use UUIDs as SSO session ids.

rndstr() uses random.choice() which does not appear to use a
sound PRNG algorithm.