only delete on POST
admin can eval