artsy/artsy-passport — pull request #36 by dblock (2014-12-12 20:32:44+00:00)
Title: @broskoski => Sign-out via DELETE only.

We have a security vulnerability whereas you can embed an `` into, say an email and get users logged out of Artsy just by opening that email. This was fixed on api.artsy.net by inserting a logout form (in https://github.com/artsy/gravity/pull/8376). This is the first step of fixing it in artsy.net by disallowing GET /users/sign_out.

cc: @craigspaeth