Yes you are correct that we need it to enforce more fine grained permissions but the reason why I removed it is:
By default the auth user doesn't has a permission to delete other users. Its only the admin user that will be able to do so.
So in general we need to make sure always that the token we use is from an admin user else the delete request will get a 403 error i.e forbidden even after the user gets authenticated via Token Authentication.
So do you think we should have it ?