Sometimes a developer adds a Content Security Policy to their page defining what 3rd party sites it will accept data from. This will cause a problem when webNetwork tries to inject its .JS code to do the SSO process.
To get around this for a virtual webapp you can add a header from the options tab :
$Content-Security-Policy: .*~
This will wipe out the pseudo security the page tried to impose.