user.delete and user.remove must use user authentication headers