Allow optional custom logout implementation for a Strategy

Some strategies could benefit from being able to define some custom logic, related to logout, e.g. a strategy for RFC 7009-compliant OAuth2 server could revoke accessToken on logout, and I'm sure there are plenty of other examples.

If I understand correctly, current implementation only allows this via monkey-patching of logout method of either SessionManager or Request.