SSO and SAML Safe When Done Right