fix issues with session destroy referring back to non-permitted urls by always redirecting to root