If you treat each move message as a move unit, you don't need delta in this message at all. Whenever server receives a move message, apply it with a hardcoded delta (say 15ms in your case).
However this is still vulnerable to message "spam" hack. Such that a client can send double or triple the amount of move messages. If the server unconditionally handles them all, the player will get 2x/3x speed.
[edit]
Server side check like maximum location delta involves RTT measurement. Eg, max_input_message = (RTT/2 + 1000.0) / SERVER_FRAME When RTT is high this check is very loose, and a cheater can try to manipulate the RTT ping to yield higher RTT.
Maybe you can try to model your message as full state snapshot, while you are still able to adapt the prediction/reconciliation/interpolation demonstrated in Gabriel's tutorial.