Comment 13 for bug 1177526

well you need allow_account_management = true to delete an account even with a reseller account token.

it's definitively a bug to allow a user to delete their own account (but not a security bug).

 I am going to fix this in master, feel free to backport it for essex.

Thanks.