added token auth to the delete route