Provisioning is explicitly triggered at the start of CoPerson::expunge(), but then called implicitly several times after as part of the various delete operations.

Ideally, beforeDelete/afterDelete would support "provision" => false (like afterSave), but Cake 2 doesn't support options for these callbacks. (Cake 3 does.)