Fix bug: Anyone can delete any package