Bad things deserve to happen to web app operators who do not protect delete and logout by putting them behind POST[1] request.

[1] pedantry - PUT, POST, DELETE implement it however you want. Just don't change database state using GET.