auth for list DELETE