require someone is logged in before they can attempt to delete an arbitrary file (SECURITY FIX)