I believe the problem lies in the use of auth.basic. The credentials entered for basic HTTP authentication are remembered by your web browser until you close it. So you are logging out, and then your browser just sends the credentials again on the next page load.

If you want to be able to log out without closing the browser, you'll need to step away from auth.basic and move to the more advanced authentication methods.

Yep, due to the nature of basic authentication - you can't log out without closing the browser. Create yourself a login view and controller, and use that instead to log in users, then the auth::logout feature will work.

Thanks, @edrands and @AndrewBNZ. I did move to using just the auth rather than auth.basic filter and got it working.