Relay Logout

When users log out of Relay, we should utilize Relay Single Sign OUT to make sure they're totally logged out
 - had reports of users who wanted to log out and then log in as someone else to register but could not do so
Is `logoutCallbackUrl` required to be url encoded here? We're not url encoding `serviceUrl` here. Isn't it the case that the CAS client will url encode for us (just as presumably it does for the `serviceUrl`)?