Fix permssion check; restrict delete to admins.