Sessions#destroy

Closes #5 and #6.
I think we should move this to base controller, since all the API will need user authentication.

In the `sessions#create` we can do a `skip_before_action`.