[api] pessimistic lock on request state changes to avoid a race condition