CSRF vulnerabilities in remove and delete forms

[jekkos]

Some of the forms have CSRF vulnerabilities due to the fact that we allow a GET in the method handling. POST should be enforced everywhere as that would block an attacker into tricking a user with a valid session into triggering form actions on these specific methods.

One case was overlooked and an extra condition is added.

[daN4cat]

Despite all the work we have done years ago in improving security, there are still issues. It's a constant learning story.