changed logout to reflect CSRF