Remove user ID from API routes

Having the user ID in the route is not helpful since we
cannot allow all users' data to be publicly accessible
Add delete for categories and time logs