OAM 11.1.2.2 application domain question

Hello - wondering if someone could tell me if this is a possible set up. Two sites (mysite.mydomain and sso.mydomain) under one application domain. I've put the host names in the host identifiers. I'd like to go to sso.mydomain with it's own auth scheme with a higher level of authentication and authenticate, then be sent to mysite.mydomain which I should be able to navigate because it's auth scheme has a lower level of authentication.

We had already set this up, but if I authenticate at sso.mydomain then try to go to mysite.mydomain it results in a browser loop. It keeps requesting /oam/server/obrareq.cgi?encquery<string> and the string keeps changing. We were able to get the authentication level to work if we authenticate at mysite.mydomain/higherauth then go to mysite.mydomain/lowerauth, no problem. Sso and mysite are both in same domain, but they are separate "hosts" (different load balancer IPs, but proxy to same OHS (http) server). I thought OAM wouldn't care if they are in the same application domain, same web gate. Any idea what I'm missing?