A developer hides the Delete button for nonmanagers. What additional protection is necessary?

1. Enforce authorization on the server-side delete operation
2. Use a smaller icon for the delete action
3. Make the button label difficult to guess
4. Add the same hidden button to another region