Scrub personal user info when disabling a user

Good points. 

Re security, I guess it's just a layer of obfuscation, perhaps we don't need it or we add a crypto hash with a secret key and never lose it. 

Re collisions, thoughts on replacement hash functions?