when the user goes, so does his contacts
clean up the code a bit: do auth verification before any request. add delete and put