Use only instead of except to limit routes used

It looks as though we were accidentally allowing the destroy route
to exist for whitelisted hosts, because we were excluding delete
instead of destroy. This fixes that issue.