Change delete_item to RESTful URL.
Include Don's change to checking access at non-course level.