Only retrieve keys for the right user for deletion

[ashokdelphia]

I think this is preferable to retrieving the record and then checking the user.

If the user passes a bad id (either non-existent, or someone else's), then the get here is going to throw a DoesNotExist. I think that's no worse than the current behaviour, but at some point it likely makes sense to handle that case explicitly, and serve a real error.

(Note also that the logic in the deleted error message is backwards.)

[ashokdelphia]

I'll re-make this once I have the tests running locally, and cover the toggle case, too.