fix logout page, add csrf security