NOTICE:
/sso/ will be moved to /auth/ and deprecated; use user_authenticated_hook() instead