Allow a CORS delete request to kill a kernel, and stop invalidating base_url

The base_url is important so that the kernel delete requests go to the right URL.

Why did we originally modify the base_url?
Allow fake DELETE request through form submission where XHR is not available