list.fhtml: Make `logout' be a POST operation.

It's really not idempotent.  And also it will spam the CSRF token into
the URL, which isn't what we want.

diff --git a/list.fhtml b/list.fhtml
index 0fb5fafb6a1a1600011489d22b19e3727df56d17..8a947aaa2b676b6e56d5a0d44d03585b89aca59c 100644 (file)
--- a/list.fhtml
+++ b/list.fhtml
@@ -130,7 +130,7 @@
 
 <h2>Log out of Chopwood</h2>
 
-<form method=GET action="~={script}H/logout">
+<form method=POST action="~={script}H/logout">
 <button type=submit>Log out</button>
 <input type=hidden name=%user value="~={user}H">
 <input type=hidden name=%nonce value="~={nonce}H">