sessions controller destroy/logout route, add flash message to create fail