Fixing nonce parsing, and checking ajax referrer on delete

Fixes #70