Log out via POST request

[hnatt]

Fixes #302

This is a breaking change since many users probably have overriden the view files, so I'm not sure this needs to be introduced to stable branches.

[JDutil]

Why not destroy?

[hnatt]

I thought "destroy" and other fancy verbs are only for RESTful routes.

[JDutil]

Sorry should be method DELETE. Like: <%= link_to 'Sign out', destroy_user_session_path, method: :delete %>

[hnatt]

"DELETE /logout" request does not make much sense. Like "logout" is a resource and we're deleting it. Should I make all routing RESTful? Or just make this "DELETE /logout" thing?

Be it POST or DELETE (which also will be simulated with a POST in browsers) does not matter in regard to CSRF.

[kushniryb]

@damianlegawiec @bbonislawski
What do you think about it? It seems like a breaking change to a lot of users so I'm not sure whether it's a smart move to merge it.
DELETE makes much more sense than GET to me though