add filter to ensure that logout is only valid via POST request