I think the auto sign in is only when using the Admin's site swapping.
To do what you want to do, it does require a little code. What i did is create a post-back button that when they click it, it adds a random GUID to the application settings with their login info, and post that to a receiving page that takes the GUID, looks up the user, logs them in then deletes the random GUID info. So it's pretty much impossible to exploit.
I'll try to export them for ya, give me a bit!