enable CSRF protection for logout

No longer allow GET requests to /logout

There were a few places in the app that were doing GET requests to
/logout, as well as some tests, so I fixed those to do a proper DELETE
request.

test plan:

  * Make sure you can log out through the web ui
  * Make sure that the cancel/logout buttons still work properly on:
    * The accept terms of use page
    * The self-registration page
    * The "already enrolled" page that you see when you click an
      enrollment invite for one user while logged in as another user
  * Make sure that SAML and CAS log outs work as well

fixes CNVS-12163

Change-Id: I6a0a520745a21b349d36b004bceccbb0ff2c8503
Reviewed-on: https://gerrit.instructure.com/32723
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>