add delete btn, 404, user role check