parseSsoResponse

consume a response uri, get the JWT, assert it’s legit, then get the
account