Add CSRF protections to state-changing endpoints

logout.php

@@ -1,5 +1,12 @@
 <?php
 session_start();
+$headers = array_change_key_case(getallheaders(), CASE_LOWER);
+$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
+if ($receivedToken !== $_SESSION['csrf_token']) {
+    echo json_encode(["error" => "Invalid CSRF token"]);
+    http_response_code(403);
+    exit;
+}
 $_SESSION = []; // Clear session data
 session_destroy(); // Destroy session