docs: function signout (req, res, next) {
    var idToken, clientId
    var params = req.query || req.body
    var postLogoutUri = params.post_logout_redirect_uri
    var idHint = params.id_token_hint
    var state = params.state
  
    if (idHint) {
      idToken = IDToken.decode(idHint, settings.keys.sig.pub)
      if (idToken instanceof Error) { return next(idToken) }
      clientId = idToken.payload.aud
    }
    authenticator.logout(req)
    if (clientId && postLogoutUri) {
      // Verify the post-signout uri (must have been registered for this client)
      return Client.get(clientId, function (err, client) {
        if (err) { return next(err) }
        var isValidUri = false
        if (client) {
          var registeredUris = client.post_logout_redirect_uris
          isValidUri = registeredUris &&
            (registeredUris.indexOf(postLogoutUri) !== -1)
        }
        if (isValidUri) {
          if (state) {
            postLogoutUri += '?state=' + state
          }
          // sign out and redirect
          return res.redirect(303, postLogoutUri)
        }
        // Otherwise, fall through to default case below
        return emptyresponse(res)
      })
    }
    // Handle all the other cases - no postLogoutUri specified, or the client is
    // unknown, or the given postLogoutUri has not been registered previously.
    // Do not redirect, simply sign out
    return emptyresponse(res)
  }