make UserPin deletion handler use POST, not GET