#53 logout needs to support tomcat CORS