limit delete routes to admins only