minor fixes

src/routes/user.ts

@@ -65,6 +65,7 @@ router.put('/user:username([/](?!key|new).?*|/?)', async (req, res, next) => {
   });
 });
 
+// TODO: only possible if no data is linked to user, otherwise change status, etc.
 router.delete('/user:username([/](?!key|new).?*|/?)', (req, res, next) => {  // this path matches /user, /user/ and /user/xxx, but not /user/key or user/new. See https://forbeslindesay.github.io/express-route-tester/ for the generated regex
   if (!req.auth(res, ['read', 'write', 'maintain', 'dev', 'admin'], 'basic')) return;