Fixes #6999 - User logout susceptible to CSRF

To avoid CSRF, logout is changed to be a POST request so
protect_from_forgery checks the CSRF token. However, in Rails 3 the only
strategy available is to nullify the session of the attacker.
This means the request will leave a warning in the logs and will go
through UsersController. Since the session is cleared at that point, the
attacked user won't be logged out, while the attacker will get a login
page in return.

This issue is probably worth revisiting on the update to Rails 4 to
raise an exception when CSRF tokens are not correct.
The menu loader is only storing this as a hash, it isn't rendering any HTML.  The home helper will render the menu item in the context of the user's session, and the authenticity token in any case is part of the page `<head>` block, rather than being stored in the menu link.