Sorry if you've already added this, but it would be super useful if the authenticated username was passed to the proxied application through a header. The normal way apache does this is to set REMOTE_USER to some kind of value.

I would imagine it would just be the email of the user, though it might be necessary to add some information about the auth type in front of it (like openid:[email protected]). I'm sure you already have some way of uniquely doing this, so it should be alright.

Doing this would allow an application to just trust that the REMOTE_USER is who the reverse proxy claims it is.

It re creates the account as if it were never authorized.

Google has decided to pull support of all of openID
http://stackoverflow.com/questions/23773275/changed-domain-error-openid-auth-request-contains-an-unregistered-domain

Which means that now domains and each new endpoint must be registered WITH GOOGLE

Would this be possible to do? I'm thinking of a situation where I want to present a user with a link that they can paste into another application that Orthus's cookie won't travel with.

I'm imagining something like:
http://example.com/content.mp4?orthus_cookie=randomstringoftextandnumbers

I don't know how this would get to the application, maybe through an HTTP header?