like 6.5.1, no need validate 'csrf token' for add/delete/update if using 'get' method; fix delete action (change 'get' to 'post' and add 'csrf token' validate)