In the Hydra docs, it says if you want a basic SSO system it suggests to use Kratos. Since Kratos is essentially an API, to use it as an SSO system do you just have different apps/services hit the API directly? Are you using Kratos to manage all sessions or are the apps/services using cookies and managing sessions locally? What is a typical set up?