User not being logged out when visiting {{ logoutUrl }} link
Turns out this was caused by me setting a "Cache-Control: max-age" header which I was testing with Google Page Speed and I forgot to move it. This meant the browser was caching everything including the session cookie.