GET /logout now available, short-circuiting CSRF protection