Included CSRF verification when deleting bought items. Modified the AJAX that replaces each row when toggling the status of the item. Modified the JS that binds the event to each row, so that it is delegated to replacement DOM elements; a row replacing an old row will still trigger the action upon listening to the same event