Fixing CSRF vulnerability in logout