add access_token check to delete function