Fix deleting of API Sign-On token on HEAD request

See comment inline in code for an explanation