Log out with a POST form.

The logout link put the CSRF token in the URL, which goes into logs and the browser history.

publish/logout.php

@@ -6,8 +6,8 @@ header( 'Pragma: no-cache' );
 include_once('../session.lib.php');
 require_once('../config.lib.php');
 require_https();
-// Only log out from our own logout link, which carries the CSRF token
-if (!csrf_valid($_GET['token'] ?? '')) {
+// Only log out from our own logout form, which posts the CSRF token
+if (!csrf_valid()) {
   header("Location: /");
   exit;
 }