user: fixed bug with CSRF while logout