Fixes #6999 - User logout susceptible to CSRF

To avoid CSRF, logout is changed to be a POST request so
protect_from_forgery checks the CSRF token. However, in Rails 3 the only
strategy available is to nullify the session of the attacker.
This means the request will leave a warning in the logs and will go
through UsersController. Since the session is cleared at that point, the
attacked user won't be logged out, while the attacker will get a login
page in return.

This issue is probably worth revisiting on the update to Rails 4 to
raise an exception when CSRF tokens are not correct.
@domcleal i see, you are right, it worth mentioning that as it stands now, the menu loader wont be able to access any helper method (with Proc or without) or anything from the original context as it stands for now, as the context of the evaluation would be the menu loader class itself.