remove forgery protection on delete (non-logged in users don't have a session due to current caching strategies)