api session certs should be deleted when related api sessions are deleted

[Paul Lorenz]

Currently they must be deleted manually first, or api session deletes will fail, as will identity deletes with api sessions/api-session certs.