It's an interesting problem. The SL2 app must not verify the OpenID assertion itself but rather pass it off to the server to verify it. The SL2 app could verify it, but then the nonce is consumed and the server couldn't re-verify it, but ultimately the server MUST verify it to be secure. So most likely login should occur before the SL2 app even appears, and then it can appear with a logged in context already there.
There are probably other ways to do it, but the above restriction of the server being the verifier of the assertion is clear.