Staff login

Action name should be `cancel`. Not `destroy`