You might want to check out ControlAuth - it handles exactly this use case. Full disclosure: I'm the creator, but I built it specifically because I ran into this same problem.