It's DELETE /auth/logout, actually