Add logout endpoint

[donaldgray]

Resolves #20

Added IIIF Authorization 2.0 Logout Service implementation at GET {customerId}/{accessServiceName}/logout.

The path takes customerId and accessServiceName but only uses the former - the accessServiceName will be handled at a later date once we handle multiple session/role-providers (in #10 (comment)).

Upon logout the service will:

• Mark SessionUser as Expired in database
• Clear possible cached SessionUser values
• Issue a new expired cookie for same domains as real cookie

As part of this I refactored SessionManagementService, pulling out common parts to base class and adding SessionCleaner class.