ApiLogout will error out when $session->canSetUser() is false. It's unclear whether that's a good thing. In MediaWiki core, action=logout means "log me out from this device" which doesn't make any sense for OAuth. But for CentralAuth, it means "log me out on all devices" (mostly because the user needs to be logged out from multiple domains, and scoping the session invalidation to the current device but all domains is hard), and it's that's a perfectly sensible functionality to call via OAuth.

So maybe we should differentiate between "local mode" and "global mode" in the API, and only do the session check in the first case.