administrator is allowed to delete user