authenticate before allowing SessionsController#destroy