prevent login/logout if xsrf_token is not set [xsrf security]