Made logout spoof safe

* changed template to call a form which submits a post with csrf token
* changed view method to ensure csrf token, only allow posts to logout