admin can delete users, cats, and reviews

Rather than redirecting to the root path, I would suggest rendering a 404. This limits the amount of information leaked to non-admin users.