fixed sign-out bug (I lost the csrf_token at some point)