Flush tenant membership deletion before user

Ensure user tenant membership is *actually* removed before deleting
user.

Fixes bug 998137.  This should be proposed to stable/essex as well.

Change-Id: I097456e603177646d62ebf08ca71af1fd7f787bf

keystone/identity/backends/sql.py

@@ -338,6 +338,7 @@ def delete_user(self, user_id):
             if membership_refs:
                 for membership_ref in membership_refs:
                     session.delete(membership_ref)
+                    session.flush()
             if metadata_refs:
                 for metadata_ref in metadata_refs:
                     session.delete(metadata_ref)