Cross site request forgery is separate from cross site scripting. He is not clamming to have done any cross site scripting. Secure sites generally require a tok

Cross site request forgery is separate from cross site scripting. He is not clamming to have done any cross site scripting. Secure sites generally require a token to perform any state changing effects, it's just odd that Google doesn't require it for logging out. Facebook uses http://facebook.com/logout.php http://facebook.com/logout.php to log you out, but clicking that link won't do it.