Facebook logout

Add endpoints for facebook logout.

- logout will return a facebook logout URL as header: X-Facebook-Logout-URL
- X-Facebook-Logout-URL contains a URL to facebook with the ERT app public ID and access_token for the user, with a "next" (service) back to the ERT home page
- X-Facebook-Logout-URL added to CORS allowed exposed headers property
I've seen some things online that refer to a "confirm" query string parameter as well.  Is that not necessary?