Issue #15619 - Protect logout against CSRF

 * Logout only performed on POST requests. GET requests returns
   confirmation page.
 * Logout link in administration replaced by logout form without change
   of appearance.

Based on patch from ashchristopher.