Read through:
https://github.com/discourse/discourse/blob/master/lib/single_sign_on.rb#L80-L83
This code is carefully tested.