[security-dev] IDP-initiated logout leaves SAMLResponse in the session