tests for user controller, prevent deleting current user