Fixed potential CSRF vuln in account lock