Fix deleting of API Sign-On token on HEAD request

See comment inline in code for an explanation
I've flagged this PR to be reviewed at the next package party as well (see the silverorange wiki).