Another attempt at enable logging in after a refreshless logout

Doing a POST to /ghost/signout will re-generate the current session (which
clears out all user data) but recycle the existing csrf token from before.