Expiration of TGT in /logout should be handled as async; /logout now accepts `service`.