private void forceBackendLogout(HttpServletRequest req) {
        RefreshableKeycloakSecurityContext session = (RefreshableKeycloakSecurityContext) req.getAttribute("org.keycloak.KeycloakSecurityContext");
        KeycloakDeployment deployment = new DeploymentWithLogoutViaBackend(session.getDeployment());
        session.logout(deployment);
    }
In setups where the Keycloak backend URL is different to the frontend URL, Keycloak's Java adapter currently
(incorrectly, AFAICT?) uses the frontend URL for logging out.
<p>
For example, this means it won't actually log out in situations where the internal Docker network has a different
name to the external network.
<p>
We work around this by forcing the backend URL with a delegate. It's not pretty...
manager/ui/war/src/main/java/io/apiman/manager/ui/server/kc/KeyCloakLogoutServlet.java