delete user uses POST not DELETE method