permanent delete is allowed only for admins