Add test to ensure non-privileged user cannot delete route