  def destroy
    current_user.invalidate_all_sessions!
    super
  end
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."