user:deprovision

naive implementation, although hopefully workable (did not tested yet against live database, but will do in minutes)

usage against own account (or from not fully privileged account) may result to unexpected (but predictable) results like roles partially revoked, etc.

Eventually I'd say we need batch (transactional) method in the REST API for doing this.

Also there's open question what to do with role which has no more memberships. And also whether we need to revoke it's role itself from all members.