move locking to application rather than db