The logout callback now properly handles expired sessions