change lockout logic to just redirect

Was unable to locally test these changes due to package app changes. It looks
simple enough and we can always back it out.