It would be good to have the option of setting the secure flag on the SSO cookie.

I understand about the requesting IP address being checked against an existing token, thats good but not bullet proof. Making the cookie secure will also help.