Yeah - there really should be.  Someone can add/remove the sso resource independently from the host.  I'll add this method.