Delete code gigantic security hole fixed

Before this fix, it was possible to send a POST to /edit/delete and
basically delete the whole database as there was no authorization. 

The work of a sys admin never stops.