Could require a POST or maybe even HTTP DELETE to guard against woopsies. The latter has semantic niceness about it.