added DELETE /api/user/:username