[api] ensure that users in state deleted are not visible