[sso] ignore messages not from the tunnel