revoke the access tokens of a user if he is deactivated by a replacement