Security issue -- Don't expose 'delete' route.