Test that logging out needs the form's CSRF token (part of #256)

A GET /logout, or a POST /logout without the CSRF token, must end no
login session; the generator page must carry a logout form with the
token; and after a logout from that form, a login opens the generator
page while a cookie copied before it is refused, also after a restart.

Model: opus-5-5

internal/handlers/auth_session_internal_test.go

@@ -185,7 +185,7 @@ func TestHandleLogout_ClearsSessionCookie(t *testing.T) {
 	}
 }
 
-// TestHandleLogout_EndsCopiedSession verifies that after GET /logout a copy
+// TestHandleLogout_EndsCopiedSession verifies that after POST /logout a copy
 // of the session cookie taken before it shows the login page, not the
 // generator page.
 func TestHandleLogout_EndsCopiedSession(t *testing.T) {
@@ -196,14 +196,14 @@ func TestHandleLogout_EndsCopiedSession(t *testing.T) {
 	copied := newSessionCookie(t, h)
 
 	req := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/logout", nil)
+		t.Context(), http.MethodPost, "/logout", nil)
 	req.AddCookie(copied)
 
 	rec := httptest.NewRecorder()
 	h.HandleLogout().ServeHTTP(rec, req)
 
 	if rec.Code != http.StatusSeeOther {
-		t.Fatalf("GET /logout status = %d, want %d",
+		t.Fatalf("POST /logout status = %d, want %d",
 			rec.Code, http.StatusSeeOther)
 	}
 
@@ -223,7 +223,7 @@ func TestHandleLogout_EndsCopiedSession(t *testing.T) {
 }
 
 // TestHandleLogout_SaveFails_Answers500 verifies that when the logout cannot
-// be saved in the database, GET /logout answers 500, leaves the session
+// be saved in the database, POST /logout answers 500, leaves the session
 // cookie in place and ends no session.
 func TestHandleLogout_SaveFails_Answers500(t *testing.T) {
 	t.Parallel()
@@ -248,17 +248,17 @@ func TestHandleLogout_SaveFails_Answers500(t *testing.T) {
 	}
 
 	req := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/logout", nil)
+		t.Context(), http.MethodPost, "/logout", nil)
 	req.AddCookie(cookie)
 
 	rec := httptest.NewRecorder()
 	h.HandleLogout().ServeHTTP(rec, req)
 
-	t.Logf("GET /logout: status %d, Set-Cookie %q",
+	t.Logf("POST /logout: status %d, Set-Cookie %q",
 		rec.Code, rec.Header().Get("Set-Cookie"))
 
 	if rec.Code != http.StatusInternalServerError {
-		t.Errorf("GET /logout status = %d, want %d",
+		t.Errorf("POST /logout status = %d, want %d",
 			rec.Code, http.StatusInternalServerError)
 	}