Fix the access check on an account delete route

An AI added POST /account/delete, which deleted whatever userId the request body named. Any caller could delete someone else's account. The fixed route takes the caller's id from the session and refuses a body id that names a different account. Your team tests that decision as a function.

An assistant wrote screen_delete_requests(request_lines). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• request_lines: one per request, with fields joined by |, such as session=u1|body=u1. session is the user id the server proved from the session cookie. body is the id the client asked to delete. Either can be missing or empty.
• Return one decision per request, in order.

Rules the tests check:

• Split a line on | and trim each part. A part that starts with session= sets the session id, and one that starts with body= sets the body id, each to the rest of the part, trimmed. When a field appears twice, the last one wins. Other parts are ignored, and a missing field is empty.
• No session id: "deny:unauthenticated", whatever the body says.
• A body id that is not empty and is not the session id: "deny:forbidden". Ids compare exactly. Case matters, so alice and Alice are different accounts, and u10 is not u1.
• Otherwise: "allow:delete:<session id>".