Allowed delete paths should be checked against the proposed config, not the active config, as is currently done due to an oversight. This allows the expected behavior of set some path; delete that same path, without the set necessarily having been committed. A simple fix.