POST /logout should be useable without a session

[sebadob]

The POST /auth/v1/oidc/logout currently does not work when an RP is using it directly with a POST. It requires an active session to be useable. It needs a small rework.

If should accept a url encoded body and as long as an id_token_hint is given, it should not require a valid session. In that case, extract the user information from the (validated) id_token and perform the logout procedure.

This will also fix a bug with the location header not being set properly with the given state.