Account deactivation query

This should only be :body. We don't trust user_id's from the client. And you don't use the supplied user_id anyway.