Logout works, including CSRF crap