code: @Override
      public void logout() {
          final boolean invalidating = !isSuppressLogoutInvalidate();
          logger.debug("...Doing logout {}", invalidating ? "invalidating session" : "keeping session");
  
          sessionManager.removeAttribute(getUserBeanKey()); // always just in case though may be invalidated later
          getCookieRememberMeKey().ifPresent(cookieKey -> {
              cookieManager.removeCookie(cookieKey);
          });
  
          // all session attributes are deleted here for more security
          if (invalidating) { // basically true
              sessionManager.invalidate(); // since 1.0.2
          }
      }
docs: ======