Added filter on 'destroy' action in User controller, to ensure only admins can destroy users.