Sessions may be destroyed by GET

[niemeyer]

The documentation informs that the /v1/session/destroy endpoint requires a PUT to destroy a session, but it turns out that even a GET will do. Might be wise to require a PUT or DELETE, as automated tooling commonly consider GET references safe for probing.