Unless there's some (licensing?) reason not to, we should put sso-provider in services/sso so our packaging and testing infrastructure handles it just like everything else, we can add it to our integration suite, etc.