Fix session destroy action (was in user model instead of session)