can now destroy users (as admin)