This allows using the endpoint to deactivate a user without deleting it. TODO: make the request body optional.