add test not allowing to set admin by mass assignment, add condition that only allows admin to delete user, refactor new user and edit user to use the same form partial