Bugfix for #354: Added auth check for cascade delete and using flattenChildren() instead of replies