Yes, that solves that. But you should use CSRF. Otherwise someone could have a <form method=POST action="http://mysite.example.com/delete>…</form>; on their site and a javascript that will submit the form upon page load.