Spring Security custom LogoutSuccessHandler gets strange Authentication object
===

I am developing an application using the Spring Security (3.1) and I encoutered the following problem. When user logs out, I want to redirect to some custom URL depending if he logs out from a secure page or not. I wrote a custom LogoutHandler, that looks as follow:

    @Override
	public void onLogoutSuccess(HttpServletRequest request,
			HttpServletResponse response, Authentication authentication)
			throws IOException, ServletException {
		
		
		String refererUrl = request.getHeader("Referer");
		if (requiredAuthentication(refererUrl, authentication)) {
		    response.sendRedirect(request.getContextPath());
		} else {
		    response.sendRedirect(refererUrl);
		}
	}
	
	private boolean requiredAuthentication(String url, Authentication authentication){
		return !getPrivilegeEvaluator().isAllowed(url, authentication);
	}

So, when the user is logging out from the non-secure page he is logged out and redirected to the same URL, and if he is logging ouf from secure page, he goes to index page.
The problem is, that Authentication object that comes to the method is always authenticated (even though, the method is called AFTER loggin out the user, acording to the specification).
My security context:

    <http use-expressions="true" disable-url-rewriting="true" request-matcher-ref="requestMatcher" >


		<intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" requires-channel="https" />
		<intercept-url pattern="/dashboard/**" access="hasRole('ROLE_OWNER')" requires-channel="https" />
        <intercept-url pattern="/**" access="permitAll"/>
        
        <form-login login-page="/login"
        			authentication-success-handler-ref="successHandler"
        			authentication-failure-url="/login"
        			login-processing-url="/validate"  />

        <logout logout-url="/logout" invalidate-session="true" success-handler-ref="logoutSuccessHandler" />

		<remember-me services-ref="rememberMeServices" key="KEY"  use-secure-cookie="false" />
        
        <session-management session-fixation-protection="migrateSession">
	        <concurrency-control max-sessions="1" />
        </session-management>
        
	</http>

Do you have any idea, why received Authentication is still valid, when gettig to the logoutSuccessHandler? I can't edit this object, because it's fields are final (except the isAuthenticated, but it's not checked by isAllowed() method..)