A SAML logout works on the main domain and loops on the callback path

A reverse proxy serves the same app successfully until logout or ACS validation starts looping under one path.