Issue #2084323 by Berdir, sandipmkhairnar, Xano, Jalandhar: EntityForm::actions() adds 'delete' without checking access.