Use SessionProvider#dispose to logout injected sessions

Previously, JAX-RS endpoints were responsible for logging out as appropriate.