FIX: Fixes #162.

- Adds a DELETE_WORKFLOW CMS permission.
- Users with this permission trump action-level perms.
- Added tests.