Thanks for getting back to us,
It seems like your current cache system cached the whole page HTML code on your server, even i never login your site before on other browser, it also cached to show I am logged in your site.
This is what i see your site header information, it showing your site enabled to use this
sucuri cache system on your server.
X-Firefox-Spdy: h2
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sun, 29 Apr 2018 03:29:29 GMT
expires: Wed, 17 Aug 2005 00:00:00 GMT
last-modified: Sun, 29 Apr 2018 03:07:01 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains; preload
timing-allow-origin: *
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN, SAMEORIGIN
x-sucuri-cache: HIT
x-sucuri-id: 16004
x-xss-protection: 1; mode=block
200 OK
The reason why it always hit this error
The most recent request was denied because it had an invalid security token. Please refresh the page and try again. is because every single login/logout, the system will generated a token code into the login/logout form under hidden input.
The tokens are randomized strings that are used to authenticate that the request being made is coming from a valid form and a valid session. This simple measure is very effective at preventing a large percentage of potential CSRF attacks, however, due to the nature of CSRF they are extremely difficult, if not impossible, to secure against completely.
Reference link :
https://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms
Once the server cached these HTML content on the page, mean it will cached that token as well, then it will cached that login/logout issue because the user always used the same token authenticate for login and logout.
Can you request with your webhosting provider to temporary disable this
Sucuri cache system first and see if the issue still persists?