Consider DELETE requests to be in 'publish' scope