fix #603 concurrent settings access

The fix is to synchronize the SettingsController Set/Delete with deployment lock.  the goal is to disallow the settings changed by users while deploying.  This makes deployment deterministic.  

As a by-product, it fixes the issue #603 as no modification can happen while deployment reading settings.