Implementing single CAS signout (without disabling CSRF)