admin controller now checks for admin user. Only admin can access delete page