Fix CSRF in logout