added csrf_token to sign out form