server: remove unnecessary locks

not required because writeResponse is wrapped inside
StartResponse/EndResponse
server: implement command list