SSO: let an SSO request sign a user in

SSO parameter authentication now results in the authenticated user being
signed in for the duration of the session cookie instead of *only* the
current page load.

Sessions will be reused if they exist.