refactor user view
add admin flag to users model
add destroy action and security checks