The subsites can be on a subdomain or a separate domain. Because of this, using cookie for impersonation is not possible as cookies are not shared across domain.
Login Process-
Check if the email provided is the super site admin. This is done by comparing it with the value in application.yml(default_company/admin_user_email).
If the email is super site admin's and if the site is not default one proceed to next step. If the site is default then normal log-in process will happen.
Validate the email and password provided. If valid then continue with the next step else show a message that the validation failed.
Retrieve the details of the sites admin and then create a session.
If the session creation fails ( example - the admin has not yet activated his email etc), then show an error message
If the session is created, then the super admin will be logged into the site as site admin.