I'm a bit puzzled by the fact that we call a private method from the outside: if we know about _destroyed_session then it should be public, no? This appears elsewhere, I won't comment everywhere but the same remark applies.