allow users to delete their account

note that this doesn't use the DELETE rest verb, because we want the user to give their password for added security