csrf fails on admin ui delete group/stem

This is an HTML link which deletes something from the DB. Should be a form with POST. Oh well, made an EL function so we can put the CSRF token in there...