CSRF: logout

[ishitatsuyuki]

<img src="https://crates.io/logout">

This won't work on GitHub of course due to it's secure image proxy, but anyway we don't want a malicious page constantly logging you out of the site!

[ishitatsuyuki]

Hmm, seems I'm being constantly logged out on refresh for other reasons. Feel free to close if this isn't a CSRF.

[debris]

I experienced the same issue

[jtgeibel]

@ishitatsuyuki and @debris the issue with being logged out on a refresh should now be resolved by #910. If you're still being logged out when refreshing a page please try clearing your browser cache and see if this is still an issue. You're browser could still be caching a version from before we added the necessary header. Also keep in mind that we are using session cookies only right now, so you currently have to log back in any time you restart your browser (see #918).

However, I agree that CSRF protections should also be added to this route.