Lock user by default

Only leave user unlocked when specifically requested because less secure