Bugfix for triggering remote requth on logout

`Warden::Manager.before_logout` was being triggered by visiting signon when your session had expired.  This had the effect of causing you to be remotely signed out of all apps that you were using.  This coupled with the fact that not all apps have been deployed with the updated gds-sso client meant that users were getting the unfriendly "You have been remotely signed out" message instead of just doing the signin redirect dance again.

Moving the `ReauthEnforcer` call into the sessions controller means that it only gets triggered on an explicit logout.