I've no idea why, but this seems to actually log out the person who clicks on the button even with CORS issues (client and server on different hosts). However in such a case the user is not properly redirected: indeed this does not solve the CORS issue so the logout process doesn't complete.
Fix #2477 (closed) Closes #4716 (closed)