Deleting Patients is possible without proper permissions

The following is possible (just confirmed on demo.openmrs.org):

1. Create a new role that has all permissions except for "Delete Patients"
   2. Create a new user, and give them this role only.
   3. Become this user
   4. Go to Administration -> Manage Patients, find a patient, go into their record
   5. Click "Voided", give it a reason, and Save Patient

This works fine, but should not be possible without "Delete Patient" privileges.