Make delete user safe

If id is an empty string, the call will look like

    POST /api/users/

which is another API call – to remove all users – we sure don't want that to happen unexpectedly.