[mms] Fix deauthenticating when a system-level logout event occurs.

Changes made re: token checking for logouts broken displaying logout
messages for certain logout types, and caused infinite loops in certain
other siutations.

The login(/logout) page must only handle destroying the session for USER
initiated logout requests.  All other logout actions need the calling
code to do the session destruction - since these actions cannot be token
protected -- since the session no longer exists to do the token
checking.