Proper way to handle session after SSO login