make sure unlock is called after refreshing oauth