Use sec-fetch-dest header for CSRF protection

Problem/Motivation

See #144538-162: User logout is vulnerable to CSRF →

According to https://caniuse.com/?search=sec-fetch-dest browser support is very good, however this is still a draft spec.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet