removed each movie on click using _id from untrusted clientside JS