delete post works, security fixes