You need a check here that the user has permission to delete. Doing it only in the UI is not sufficient.