Postgres sensibly does not allow a row to be deleted if it is referenced from somewhere else, so once a user has an entry in the oauth table, i.e. once they login, they can never be deleted.
Either #21 should be resolved by using user ids and user accounts should only ever be disabled not deleted, we should clean up the corresponding entry in the oauth table before deleting the user.
However this would still prevent any user who ever checked something out from being deleted.
Deleting users was a bad idea, the rows really should just be flagged as unused.