FEATURE: change SSO to use sha256 HMAC, which is more secure
FEATURE: SSO to handle return_path automatically
BUGFIX: sso to respect must_approve_users
BUGFIX: sso to send welcome emails