Unregister the authentication mechanism with the host on SingleSignOnService.stop(...).
<single-sign-on domain="..."/> attribute should be required.
Just accept cookies from any domain for now.