work on device permissions scaffold
adding a /delete route for individual devices, the DELETE method was struggling with CORS