fixed a bug in /products - method=delete works correctly now

I was working through the shopping cart example when I realized that items weren't being removed when clicking the delete button. Instead I was redirected to /products#BadInput. I did some digging and created a working solution. Any suggestions or direction is appreciated - thanks. 
looks like this actually should be 'If we don't *add* the Cross-Site Request Forgery token'. Would you mind fixing that as a part of this PR since you're already in there?