What are your recommendations for balancing the convenience of single sign-on (SSO) with the need for robust security measures? Share one key principle.