I always thought you couldn't implement logout with HTTP basic auth, but according to this:

logging out is done by simply returning a 401 without www-authenticate header

I did not know that worked!