http: fix Single Sign-On handling