added CHECK_PERMISSIONS to delete and patch. Also add extra parameter to permissions to include document being inserted
bug fix in delete

Delete was assuming there was a request_body available like there is for
post and patch.  This isn't the case so the document has to be retrieved
so the user's permissions to it can be checked.
Merge branch 'ac4ac'