www/_nav, app.js: add a global lock; loading-spinner