SEC-2543: Logout with CSRF enabled requires POST by default