An unauthenticated user can delete a post / page

The DeletePage action does not have the authorize attribute. I guess I don't have to explain further! But, the following javascript would delete a post/page with id 3, if it exists, even if the user is not authenticated!

```javascript
$.ajax({
   type:'POST',
   url: 'http://<something>/admin/delete/3',
   success: function(){
       alert('success');
   }
});
```