add destroy method to admin and add CSRF to angular