stop a user from deleting their own account

req.user.id is a string, req.user._id is an Object.  Switched to req.user.id