From a UI point of view, it probably makes most sense to always do a form POST for logout. That would remove the need to have API and redirect logic in the UI, and is probably more inline with the authentication APIs.