bug fix in delete

Delete was assuming there was a request_body available like there is for
post and patch.  This isn't the case so the document has to be retrieved
so the user's permissions to it can be checked.