Staff login

Action should be cancel and not destroy. Also, the HTTP method for this should be put / patch. Not delete.