Do we do an AJAX logout or a form POST logout? I'm wondering if we need to streamline the response to be one of:

1. Always a redirect, in which the UI should do a form POST for logout
2. Always a 200, in which the UI should do an AJAX GET, and decide what to do w/ the GET request body (e.g., maybe it has a redirect URL, or some other kind of instruction)

In both cases, the logout implementation doesn't necessarily need to have full access to the response object. It could return a redirectURL, for example, in which case this base logout method could do one of send the redirect to that URL, or give a 200 with a body of: `{'redirect': <strategy logout response>}`.