protect cross user deletion!