 										should.not.exist(err)
 										(transDoc == null).should.be.true
 										done()
+
+			it "should only allow admin users to remove transactions", (done) ->
+				transactionData.clientID = "transaction_to_remove"
+				tx = new Transaction transactionData
+				tx.save (err, result) ->
+					should.not.exist(err)
+					transactionId = result._id
+					server.start null, null, 8080, ->
+						request("http://localhost:8080")
+							.del("/transactions/#{transactionId}")
+							.set("auth-username", nonRootUser.email)
+							.set("auth-ts", authDetails.authTS)
+							.set("auth-salt", authDetails.authSalt)
+							.set("auth-token", authDetails.authToken)
+							.expect(401)
+							.end (err, res) ->
+								if err
+									done err
+								else
+									done()

									newTransaction.request.method.should.equal "POST"
									done()

		describe ".updateTransaction", ->
			
			it "should call /updateTransaction ", (done) ->

									done()

		describe ".removeTransaction (transactionId)", ->

			it "should call removeTransaction", (done) ->
				transactionData.clientID = "transaction_to_remove"
				tx = new Transaction transactionData
