I can appreciate your concern about changing the user experience by delegating to the logout flow; I'm not certain control could return gracefully to the login flow in all cases, which should be what we strive for. With that concern in mind, I'm leaning toward you suggestion of factoring out common ticket/cookie cleanup from LogoutAction into a common action that can be called from both login and logout flows as needed. I'll proceed with that approach. We will still need the four states I mentioned above.