REST API: fix deleting a product/service.

The global variable $user must be set before calling the
Product::delete() method else the check of permissions fails.