server message consistency
in Users.delete, the username is not taken from auth but is passed as argument (as the API says)