Need CSRF on URL called on logout