A slight nitpicky concern here is that we're breaking some of the SSO abstraction provided in app/controllers/concerns/foreman/controller/authentication.rb (e.g. sso_authentication).  It feels like we should follow that method, but without the support_login/fallback and redirects.  If so, we could simply use SSO::Apache too.