Add require csrf_token decorator
Add user status view and require_csrf to logout
Change to correct http code (400 instead of 403)