I'm hesitating on this...
Should we really call SLO here ? Isn't it an explicit action from the user ?

What we want is to avoid displaying "you're authenticated" if the user is not authenticated.

As we are close to the RC1, I'm in favor of an easy and less intrusive solution :
can't we just "update" the initial flow action not to store the TGT in context (and delete cookies) if the TGT is expired ?