Add security constraint in design when obfuscating or deleting user account

[xcoulon]

the lack of a.Security("jwt") means that the generated client will not include an Authorization: Bearer ... header in the request.