updated purchases controller to only allow delete from users who purchased items.