"delete ruleset" now has CSRF protection (see #23)