Shield support for SSO apps/protocols

makes sense, thanks Steve