change delete post authentication logic

this reorders the logic for checking authentication on post deletes to
first check for a provided edit token and after check for an access
token or auth'd user.