add 'role' field to user
fix err message format
added PUT and DELETE routes
added check for 'admin'