destroy-user: Handle missing param, fix /old/ removal