fix logout config

spring-security not support calling logout url by "GET" method when CSRF enabled.
we need to choose between to disable CSRF or set logoutRequestMatcher instead of logoutUrl.
otherwise, 404 return, when request "/logout.do"