xsrf protection for logout