Correct logic for registering single sign out HTTP session listener in web.xml