* update internal user doc string * add readme on location of /sso routes * add custom_sso_handler * docs custom sso * use secure=True for cookies