Auth logout not working with defaultCsrfMiddleware

[haekhaek]

I tried out the authentication example from yesodweb, but if I add the "defaultCsrfMiddleware" to my "yesodMiddleware" the logout mechanism with the auth plugin does not work and I get the "Permission denied" error. But the XSRF-TOKEN is send with the cookie and it's the same token as in the session, so the logout should work.

I got the logout working with either:

• Don't set defaultCsrfMiddleware
• Or hack the logout form by adding an invisible input with the token manually(in the browser (after disabling javascript)).

I think it would fix this error, if we add here an invisible input with the token like it's done by the runFormPost.

But I'm not sure if that's all.

[snoyberg]

@gregwebs any objection to removing the csrf middleware from the scaffolding? I don't know anything about it, but this is the second bug I've seen new users report.

[snoyberg]

I've just released version 1.4.19 of yesod-core which should fix this problem. I've also sent a PR to remove defaultCsrfMiddleware from the scaffold. Thanks for the report!