Allow setting custom logout endpoint URL

[marcusforsberg]

SAML2-js doesn't seem to implement a way to set a custom logout URL. It instead uses the assert URL. We need a way around this. See Clever/saml2#159, Clever/saml2#139

[FossPrime]

We don't need a way a round this... The request we get from IDP is drastically different from a login assertion, so it can be handled with a logout response. So is the response, which can be handled with the same or a separate redirect.

We can do it by using the SAML session token, if it doesn't exist, JWT should be disallowed. As long as we update the user, remove the session, and disable fallback authentication. we'd have to extend the JWT strategy as SamlJWTStrategy.