Bad things deserve to happen to web app operators who do not protect delete and logout by putting them behind POST[1] request. [1] pedantry - PUT, POST, DELETE

Bad things deserve to happen to web app operators who do not protect delete and logout by putting them behind POST[1] request. [1] pedantry - PUT, POST, DELETE implement it however you want. Just don't change database state using GET.