This function continues to be unsafe in the presence of failures. We delete the bucket locally before forwarding the delete to the master, but if the bucket doesn't exist locally we don't forward the request. If we delete locally, then crash, the user is stuck.
This may or may not be an issue we need to fix right now (though I certainly lean towards now), but I'm not clear on why it's safer to forward the bucket delete after doing the local delete. Is the local region doing more careful checks than the master is? Please detail in the commit message.