Fix #311: prompt password when destroying account