code: protected void destroyApplicationSession(final HttpServletRequest request, final HttpServletResponse response) {
          LOGGER.trace("Destroying application session");
          val context = new J2EContext(request, response, new J2ESessionStore());
          val manager = new ProfileManager<>(context, context.getSessionStore());
          manager.logout();
  
          val session = request.getSession(false);
          if (session != null) {
              val requestedUrl = session.getAttribute(Pac4jConstants.REQUESTED_URL);
              session.invalidate();
              if (requestedUrl != null && !requestedUrl.equals(StringUtils.EMPTY)) {
                  request.getSession(true).setAttribute(Pac4jConstants.REQUESTED_URL, requestedUrl);
              }
          }
      }
docs: Destroy application session.
  Also kills all delegated authn profiles via pac4j.
  
  @param request  the request
  @param response the response