API: Make sure 2 API servers can't grab the same device.

Lock the device row for update and set READ COMMITTED so the next read for a
device will not show the one grabbed by the first API server.

Change-Id: I3d2ed7e30172ce07d6a6147dbc242a86cd6e1d9b