Require HTTP POST for signing out

This should leave the sign out flow the same as always for users with JS running, others will be directed to /sign-out.html and have to submit an HTML form. Considering most functions of the site won't work without js anyway, I think this is OK.