more /login as credential requestor features
handled
* ?gateway for non sso session requests
* sso session redirect to service