Web app users can delete their accounts, they re-enter the password and if it fits, the account and its assets are removed (soft deletion).
They can register using an email (and a password) or using Facebook (hellojs and passport).
The self delete is simple for email+password registered users, for the rest we can't ask for their passwords because we don't have something to compare.
So the question is; should they be allowed to delete their account without extra security measures?, or there is a way to ask them to enter the pass in FB again, and that FB tells me it was ok?
About this question: it has some security aspects that could make it a fit for security.stackexchange, and some UX concerns that could go to the other specialized site, and API checks that may belong to SO, looks like it belongs here, since can't be 100% sure feel free to migrate/edit/close/etc.