server: use per-connection lock