Require POST request to logout

[rc4]

Previously, /logout was available via GET, which could allow any site to log users out via CSRF (e.g. with an img tag). I made a few updates as part of this:

1. Updated the /logout view to require a POST request. GET/other verbs now return a 405
2. Upon successful logout and redirect to the login page, users are now shown a logout success message
3. Replaced the logout dropdown link with a button + hidden form with CSRF token; added CSS to style the button (replaced an old and unused logout button rule)
4. Added tests - POST /logout logs the user out as expected, GET /logout just errors and doesn't destroy the session

(also some minor tidying up of the existing code while I was in the test_views file already)

N.B.: I tried updating just the main.scss file and running dart-sass on it to generate the new css, but the resulting output was very different from the existing main.css - so I just ended up updating that by hand. Running a newer Sass version against it or (possibly) dropping the compiled .css from source control entirely might be things to consider? I am far from a UI expert though, so take those suggestions with a grain of salt, I suppose 🙂

[coveralls]

coverage: 68.486% (+0.08%) from 68.409% — rc4:post-to-logout into strongswan:master

[rc4]

Howdy @tobiasbrunner,

I'm sure you are busy, but would you (or someone) be able to take a look? :-) Please do let me know if there's anything I can help with/do. Thank you!