The old route was a DELETE method that took a request body. The
body is sometimes stripped by some proxies, so this new method
does not require a request body, and the member (to whom the privilege
is revoked) is now in the route itself as a parameter.