When the endpoint is hit, we delete the ApiKey from the database. The
user is left behind to ensure that we don't break foreign keys, and to
enhance auditability.