Mild CSRF vulnerability: logout action works via GET request without a token

[hnatt]

Being logged in to a Spree store example.com a user will be logged out every time he/she visits any webpage with a <img src="http://example.com/logout" /> in it. I understand that's not a security threat, but in can be used, say, by rival companies to cause a nuisance.

Will do a PR to fix this in few minutes.