Add support for logout CSRF (#1239)