Clear account ID if token does not map to a user

It's possible there are acceptable use cases for still matching account
ID if the account no longer maps to a user, but it's equally possible
that this can cause confusion. Removing it seems safer.

internal/auth/auth.go

@@ -327,6 +327,7 @@ func (v verifier) performAuthCheck() (aclResults perms.ACLResults, userId string
 			if userId == "" {
 				v.logger.Warn("perform auth check: valid token did not map to a user, likely because no account is associated with the user any longer; continuing as u_anon", "token_id", at.GetPublicId())
 				userId = "u_anon"
+				accountId = ""
 			}
 		}
 	}