Thanks for the expert feedback. From my very limited sec experience, I saw account_id in cookie, and identified that as a red flag. OTOH, I think a random token in the cookie, identifying a server-side session that stores the account id, would be a good approach, as it's the classical HTTP auth implementation. For example, what the Rails tutorial describes [1].

For SSO, the other apps can ping the cookie-originating app: "Hey, who is this browser with this cookie token" ?

[1] http://ruby.railstutorial.org/