Just one thing

Check any of the methods except Customizer.defaults() and see what methods or details they show,accordingly the requirement is to attach the mentioned api to the jsession id of the session check once in the logOut where you are deleting the jsessionid ,as per what i can see might be wrong,before the session ends, the jsession id is required