Found the bug

tryBasicLogin() would always overwrite the session if PHP_AUTH_USER+PASS were present even if it wasn't valid.  Since this runs before the logout code, the logout code could never run because the session was just invalidated.