Lack of TLS Certificate Validation during initial SSO Authentication