deleting a user now deletes api tokens.