add a test for submitting DELETE request as a wrong user