only delete :username + :key on deauth