simple locking, skipping other than GET reqs