Delete operation occurs within GET method

[halfer]

The code here indicates that a delete operation can be conducted within a GET operation. This is not ideal, as an automated system (web crawler, link pre-fetcher) might go off and delete things, seemingly at random.

To protect against this, wrap the item list in a POST form and use a submit button for the delete. The handler code needs to be updated to only respond to POST, too.