fix logout config

spring-security not support calling logout url by "GET" method when CSRF enabled.
need to choose between to disable CSRF or set logoutRequestMatcher instead of logoutUrl