added auth required for DELETE and form flash msg