allow destroy for logged on users