fixed delete /user
Added ACL