Fixed csrf in logout