fixed bugs with csrf on logout