fix: sign out (#14376)

#### PR Dependency Tree


* **PR #14376** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Sign-out functionality now works in more scenarios, including when
headers are absent or duplicated.

* **Tests**
* Added test coverage for sign-out behavior across different header
configurations.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/core/auth/controller.ts

@@ -245,7 +245,10 @@ export class AuthController {
       | string
       | undefined;
     const csrfHeader = req.get('x-affine-csrf-token');
-    if (!csrfCookie || !csrfHeader || csrfCookie !== csrfHeader) {
+    if (
+      csrfHeader && // optional for backward compatibility, drop after 0.25.0 outdated
+      (!csrfCookie || csrfCookie !== csrfHeader)
+    ) {
       throw new ActionForbidden();
     }