saved attribute into security token so application can get and user it later.  Also do redirect after logout to root of applicaiton url.