The change that went into Foreman as 4e3a7e7a2a5 prevents /users/logout to be called as GET. Alas, app/services/sso/form_intercept.rb defines controller.main_app.logout_users_path as logout_url. Logging out from user session which was started via PAM-based (intercepted) logon form login fails with

The page you were looking for doesn't exist.
   You may have mistyped the address or the page may have moved.