Fixed 'api_call' method for all request methods.
User delete function now deletes associated permissions. (users module)