Fixed #15619 – Added CSRF protection in logout.

Logout in now performed only on POST requests.
GET requests return confirmation page.

Based on patches from ashchristopher and vzima.