Need an endpoint to log out of SAML idp. There's a SingleLogoutService location if provided to redirect to in the metadata.xml, and of course clear cookies.