Hmm tried to replicate, used an exact copy paste of your

ImageDelete

above and seems to work fine on my side 😕 😮 (Using Matt Leyman's method of putting csrf in the request headers)