Only add XID if secure forms is enabled
Fix returning to /index when user logs out from homepage