pass scrub_data param when calling destroy. avoids security flaw.