Logged-in users can delete one of their private indices.

Note that per-user functionality is still experimental and will be
disabled by default, so this action will do nothing for now.
Furthermore, many checks are done to ensure there's nothing bad going
on, and the person performing the request created the index and is
authorized to delete it.
Change index creation from POST to PUT.

PUT makes more sense because we know the new index's URL in advance.
(POST is more appropriate when the operation is expected to generate a
URL for the new resource and return it)