you might have a race condition here  you probably want to disable the users first and foremost before doing anything else  a user could potentially be logged in  and creating tokens and credentials while you are deleting them  and you could end up with one hanging around after you thought yoyu had removed them all  this is non transactional  after all 