maybe we're missing ```:dependent => :destroy``` here? or I don't see any code handling deletion of auth source with existing external usergroups