destroy session URL includes session ID.