you're now logged out server-side when you're banned, so csrf token doesn't work in app.logout