Delete action is not protected against csrf attack. In my opinion, there should be some generic solution to prevent object action against this kid of attack.