admin can delete user. closes #11