diff --git a/nodejs/models/user_ldap.js b/nodejs/models/user_ldap.js
index 462c686..6a84f0c 100644
--- a/nodejs/models/user_ldap.js
+++ b/nodejs/models/user_ldap.js
@@ -325,8 +325,6 @@ User.verifyEmail = async function(data){
 		let token = await InviteToken.get(data.token);
 		await token.update({mail: data.mail})
 
-		console.log(`email link ${data.url}/login/invite/${token.token}/${token.mail_token}`)
-
 		await Mail.sendTemplate(
 			data.mail,
 			'validate_link',
diff --git a/nodejs/routes/group.js b/nodejs/routes/group.js
index 685b8b5..39d01bd 100644
--- a/nodejs/routes/group.js
+++ b/nodejs/routes/group.js
@@ -8,8 +8,6 @@ router.get('/', async function(req, res, next){
 	try{
 		let member = req.query.member ? await User.get(req.query.member) : {}
 
-		console.log('member', member)
-
 		return res.json({
 			results:  await Group[req.query.detail ? "listDetail" : "list"](member.dn)
 		});
diff --git a/nodejs/routes/user.js b/nodejs/routes/user.js
index cbe3a1a..a6a17ba 100755
--- a/nodejs/routes/user.js
+++ b/nodejs/routes/user.js
@@ -2,6 +2,7 @@
 
 const router = require('express').Router();
 const {User} = require('../models/user'); 
+const permission = require('../utils/permission');
 
 router.get('/', async function(req, res, next){
 	try{
@@ -15,6 +16,8 @@ router.get('/', async function(req, res, next){
 
 router.post('/', async function(req, res, next){
 	try{
+		await permission.byGroup(req.user, ['app_sso_admin'])
+		
 		req.body.created_by = req.user.uid
 
 		return res.json({results: await User.add(req.body)});
@@ -25,7 +28,14 @@ router.post('/', async function(req, res, next){
 
 router.delete('/:uid', async function(req, res, next){
 	try{
-		let user = await User.get(req.params.uid);
+		let user;
+
+		if(req.params.uid.toLowerCase() === req.user.uid.toLowerCase()){
+			user = req.user;	
+		}else{
+			user = await User.get(req.params.uid);
+			await permission.byGroup(req.user, ['app_sso_admin'])
+		}
 
 		return res.json({uid: req.params.uid, results: await user.remove()})
 	}catch(error){
@@ -35,9 +45,14 @@ router.delete('/:uid', async function(req, res, next){
 
 router.put('/:uid', async function(req, res, next){
 	try{
-		let user = await User.get(req.params.uid);
+		let user;
 
-		// console.log('update user', user);
+		if(req.params.uid.toLowerCase() === req.user.uid.toLowerCase()){
+			user = req.user;	
+		}else{
+			user = await User.get(req.params.uid);
+			await permission.byGroup(req.user, ['app_sso_admin'])
+		}
 
 		return res.json({
 			results: await user.update(req.body),
@@ -68,7 +83,15 @@ router.put('/password', async function(req, res, next){
 
 router.put('/:uid/password', async function(req, res, next){
 	try{
-		let user = await User.get(req.params.uid);
+		let user;
+
+		if(req.params.uid.toLowerCase() === req.user.uid.toLowerCase()){
+			user = req.user;	
+		}else{
+			user = await User.get(req.params.uid);
+			await permission.byGroup(req.user, ['app_sso_admin'])
+		}
+
 		return res.json({
 			results: await user.setPassword(req.body),
 			message: `User ${user.uid} password changed.`
diff --git a/nodejs/views/home.ejs b/nodejs/views/home.ejs
index a802f65..21b669a 100644
--- a/nodejs/views/home.ejs
+++ b/nodejs/views/home.ejs
@@ -157,6 +157,8 @@
 			renderProfile(user);
 			renderUserGroups(user);
 			$('#username').text(user.uid);
+			$('form[action="user/{{uid}}"]').attr('action', 'user/'+user.uid)
+
 		});
 
 	});
@@ -263,9 +265,19 @@
 				<button type="button" onclick="editUser()" class="btn btn-warning btn-lg shadow ">
 					<i class="fad fa-user-edit"></i>
 				</button>
-				<button type="button" onclick="app.user.remove({uid: currentUser.uid}, function(){app.util.actionMessage('username {{uid}} delete.', $(this), 'danger')})" class="shadow btn btn-danger btn-lg float-right">
+
+				<form action="user/{{uid}}" method="delete" onsubmit="formAJAX(this)" evalAJAX="window.location.href = '/users'" class="float-right">
+					<button type="submit" class="btn btn-lg btn-danger">
+						<i class="fad fa-user-slash"></i>
+					</button>
+				</form>
+
+
+<!-- 				<button type="button" onclick="app.user.remove({uid: currentUser.uid}, function(){app.util.actionMessage('username {{uid}} delete.', $(this), 'danger')})" class="shadow btn btn-danger btn-lg float-right">
 					<i class="fad fa-user-slash"></i>
-				</button>
+				</button> -->
+
+
 			</div>
 		</div>
 
diff --git a/nodejs/views/users.ejs b/nodejs/views/users.ejs
index 04a80bc..4fcb9bb 100755
--- a/nodejs/views/users.ejs
+++ b/nodejs/views/users.ejs
@@ -20,15 +20,17 @@
 			{{#sshPublicKey}}<i class="fad fa-check-square"></i>{{/sshPublicKey}}
 		</td>
 		<td>
-			<button type="button" onclick="app.user.remove({uid: '{{uid}}'}, function(){renderUsers('username {{uid}} delete.')})" class="btn btn-sm btn-danger">
-				<i class="fad fa-user-slash"></i>
-			</button>
+			<form action="user/{{uid}}" method="delete" onsubmit="formAJAX(this)" evalAJAX="renderUsers('Deleted {{uid}}', 'success')">
+				<button type="submit" class="btn btn-sm btn-danger">
+					<i class="fad fa-user-slash"></i>
+				</button>
+			</form>
 		</td>
 	</tr>
 </script>
 <script type="text/javascript">
 
-	function renderUsers(actionMessage){
+	function renderUsers(actionMessage, type){
 		var rowTemplate = $('#rowTemplate').html();
 		var $target = $('#tableAJAX');
 
@@ -44,14 +46,14 @@
 
 			$target.fadeIn('slow');
 
-			app.util.actionMessage(actionMessage || '', $target, 'info');
+			app.util.actionMessage(actionMessage || '', $target, type || 'info');
 
 		});
 	}
 
 	$(document).ready(function(){
 		renderUsers(); //populate the table
-		$('form[action="user/"]').attr('evalAJAX', 'renderUsers()')
+		$('form[action="user/"]').attr('evalAJAX', 'renderUsers("User added", "success")')
 	});
 </script>
 <div class="row" style="display:none">