Use `'delete' in request.form`
 The value is an English string and can't be trusted.