Shouldn't destroy have the same permission check as create? It looks to me like anyone can delete any domain?