philipn: remove ssotoken from TO, get from header or cookie