custom action handling/delete approve missing sesskey checks

[danmarsden]

Please see more information on this here: https://moodledev.io/general/development/policies/security/crosssite-request-forgery

Note this is a security guideline violation so it's typically a blocker for plugins db approval.

[erudisiya]

Fixed