added user#delete permission check