Don't save password store on lock; it's saved on update anyway.
Use MVar rather than IORef for PasswordStore, to make the thing thread safe.