Drupal SSO generates incorrect user sessions