How would you make SSO work without cross domain posts?