todo was on the wrong place
Destroy the session explicitly
add group checking even when user change the controller, without a new sign-in