deleting session does not need auth