don't use csrf_exempt everywhere

fedireads/templates/layout.html

@@ -27,6 +27,7 @@
                 <div id="account">
                     {% if user.is_authenticated %}
                     <form name="logout" action="/logout/" method="post">
+                        {% csrf_token %}
                         Welcome, <a href="/user/{{ request.user.localname }}">{{ request.user.localname }}</a>
                         <input type="submit" value="Log out"></input>
                     </form>