experimental fix to sso double login for admin user

By making the database sessions path redirect to the SSO session (unless a plain_login param is set - analogous to ?canvas_login=1 to let us in in the event of SSO failure), this should solve the double-login bug we saw with test+admin.