Clear out the session variables on the callback
make CAS filter cover the logout endpoint too