rest: no auth needed for the delete

uuid is known only by the client
rest: update sessions api docs