I'm trying to avoid duplicating cookie handling. Simply calling CentralAuthenticationService#destroyTicketGrantingTicket() and deleting cookies feels like the easiest and most consistent behavior. With the factoring out suggested by @mmoayyed, we could avoid doing the heavy front-channel SLO. I'm going to continue in that vein (not much work), and you can comment on the forthcoming commit. If we can't come to consensus I'm simply going to punt to 4.0.