if all the client needs is to see a 401, can't you just make a static /logout page that always renders a 401?