log out link now sends a POST instead of a GET