Should this do a host.getValue().unregisterAdditionalAuthenticationMechanism("sso")?

Even if the answer is yes, I don't think this should block getting this in if all else is ok.