fixed cleanup in deny user request