Once you authenticate, clicking on the logout button redirects you back to the authentication page however it does not cause the session cookie to be deleted as it should.

To avoid browser issues like this, we should probably find a way to blacklist session cookies for sessions where an explicit logout was called, and simply refuse service if such session is revived.

This will also prevents access if a session cookie was stolen.