Logout should only work as a POST request

"...GET requests should always be idempotent. For example, your sign-out should only work as a POST request so that someone cannot make your users sign out by just including an img tag in their forum signature."
(Tips from an ex-Digg webdev @ http://duruk.net/some-web-development-tips/)

If concerned that "logout" should be a link instead of a form button, you can style a button to look like a link and the underlying functionality still works: http://stackoverflow.com/questions/4111743/html-anchor-to-send-post-data-on-click