Made the delete/update visibility logic better

because I discovered request.params.get_all(<name>)

And some other things, but don't remember exactly what