Disallow DELETE requests

At some point we’re probably going to introduce a way to merge or remove needs. Until then, let’s explicitly refuse `DELETE` requests.