Add CSRF check on login and logout

This is a minor issue and not worth a backport in my opinion as it could break more things than it's worth having it.