code: public void logout (HttpServletRequest req, HttpServletResponse rsp)
      {
          // nothing to do if they don't already have an auth cookie
          String authcode = CookieUtil.getCookieValue(req, _userAuthCookie);
          if (authcode == null) {
              return;
          }
  
          // set them up the bomb
          Cookie c = new Cookie(_userAuthCookie, "x");
          c.setPath("/");
          c.setMaxAge(0);
          CookieUtil.widenDomain(req, c);
          if (USERMGR_DEBUG) {
              log.info("Clearing cookie " + c + ".");
          }
          rsp.addCookie(c);
  
          // we need an unwidened one to ensure that old-style cookies are wiped as well
          c = new Cookie(_userAuthCookie, "x");
          c.setPath("/");
          c.setMaxAge(0);
          rsp.addCookie(c);
      }
docs: Logs the user out.