add destory method, with authentication