Check usages server-side before allowing deletion

[mbarton]

Double check all usages are gone. At the moment, this is just client-side.

NB: access to deletion at all is behind a permission, which is currently checked server-side

#400