allow package owners to easily remove their packages

naturally i had to publish the userId from the packages collection for this to work, not sure if there is any specific reason to not publish the userId?