prevent logout against CSRF token
update path to cache