Fixes: #13997

Problem

command=samlSlo (SAML Global Log Out) responds with a 302 redirect that carries no Set-Cookie header clearing JSESSIONID/userid/sessionkey. The browser therefore keeps the session key after logout, CloudStack appears to loop during sign-out, and users have to clear the browser cache (or use an incognito window) to log in again.

Root cause

SAML2LogoutAPIAuthenticatorCmd#authenticate calls resp.sendRedirect(...), which commits the response. ApiServlet's LOGOUT_API cleanup — the loop that echoes the received cookies back with an empty value and Max-Age=0 (ApiServlet L333-340) — only runs after the authenticator returns. By then the 302 is already committed, so its Set-Cookie headers are silently dropped.

Fix

Clear the session cookies (JSESSIONID, sessionkey, userid, ...) on the response before sendRedirect(...) in all four redirect paths of SAML2LogoutAPIAuthenticatorCmd, mirroring the existing cookie-cleanup loop in ApiServlet. The committed 302 now instructs the browser to drop the session cookies, and the next login starts with a fresh session key.

Testing

• New unit test testAuthenticateClearsSessionCookiesBeforeRedirect verifies the received JSESSIONID/sessionkey cookies are cleared (Max-Age=0, empty value) and added to the response before the redirect.
• A standalone servlet-contract simulation confirms the mechanism: cookies added after sendRedirect are dropped from the committed 302 (bug reproduced), cookies added before sendRedirect are delivered (fix verified).