[vikramkr]

The requirement is for POSTs in general, not just deletes. Anything that does actions outside of the system instead of just getting data

[wilg]

The wording is ambiguous, but probably should apply. Also the rule should not be based on HTTP verbs at all since that's the wild west.