Authorising deleteBooking for normal users - doh!