Google does not consider this to be a security vulnerability (or at least not one they feel they can deal with). See http://www.google.com/corporate/rewardprogram.html (Logout cross-site request forgery is the section to look for).