make CAS filter cover the logout endpoint too