     app.delete '/users/:id'
     , middleware.requireMinPrivilegeLevel(privilegeLevels.admin)
     , (req, res, next) ->
+        if parseInt(req.params.id) == ROOT_USER_ID
+            return res.status httpStatus.FORBIDDEN
+            .json { error: 'this user cannot be deleted' }
+
         db.get 'SELECT * FROM tUser WHERE id = ?', req.params.id, (err, user) ->
             return commonResponses.databaseError res if err?
 

            return res.status httpStatus.FORBIDDEN
            .json { error: 'you cannot set your user level' }

        db.get 'SELECT * FROM tUser WHERE id = ?', req.params.id, (err, user) ->
            return commonResponses.databaseError res if err?


module.exports = (app, db) ->
    app.options '/users', options ['GET', 'POST']
    app.options '/users/:id', options ['GET', 'PATCH', 'DELETE']

    ROOT_USER_ID = 1

    app.get '/users'
    , middleware.requireMinPrivilegeLevel(privilegeLevels.admin)
