We should use the users.ensureAuthenticated middleware here, since response deletion always requires a user ID. Then theoretically the `responses.del` code should never need to return a 401 status, since the middleware takes care of that.