user should be destroy at end only