Fix deleting of API Sign-On token on HEAD request

See comment inline in code for an explanation
> If the third-party implemented integration in JavaScript this is probably HTTP OPTIONS followed by HTTP GET rather than HEAD followed by GET.

You wouldn't implement the API in javascript. It uses secret keys that need to be on a server and not on the client.

> I though the 3rd party was supposed to run this code on their server, in which case no pre-flighting should occur.

This is the landing page that the user's browser gets redirected to with a unique token generated by the server-side API code.