Issue/428

Fix url redirect encoding bug (see issue #428).
Add open-redirect/CSRF protection
CSRF protect logout links