make the * delete endpoint admin only