added a before_action to ensure only admins can delete users
added tests to ensure only admins can delete users