Use the destination in $_GET to find a redirect destination.
Allow the user to specify the first SSO redirect URL explicitly.
Allow a lower cookie domain to be used when clearing cookies.
Validate the domain name less strictly.
Account for the logout cookie on the path oauth2/authorize.
Multiple SSO script fixes