divide UserRecordMixin into base class providing user record info and derived class also providing protection against deletion by non-users
bugfix: permit_delete = [] blocked any deletion attempt even from owners of the object