Fixed destroy authorization and controller