finished with destroy
tested auth