Fix security logic for DELETE requests