Make sure QuerySet.delete() operation does not bypass protection

This fixes #1
Add missing query.py to repo
Merge pull request #1 from paltman/master

latest