Log out with a POST form.

The logout link put the CSRF token in the URL, which goes into logs and the browser history.

style.css

@@ -146,6 +146,23 @@ footer#bottom p {
     margin-right: 5px;
 }
 
+/* The logout button looks like the links next to it */
+#sidebar .links li form {
+  display: inline;
+}
+#sidebar .links li button {
+  padding: 0;
+  border: 0;
+  background: none;
+  font: inherit;
+  color: inherit;
+  cursor: pointer;
+}
+#sidebar .links li button:hover {
+  color: #FF0000;
+  text-decoration: underline;
+}
+
 #sidebar .links .sideinput {
   padding: 1px;
   padding: 0;