Which HTTP method should Login and Logout Actions use in a “RESTful” setup

You should use POST – using GET for these actions can lead to issues with browser prefetching and search engine spidering. See (1, 2)