Spend less time in locks

Now only attribute assignments are locked, not the whole .update() call

.update_lock is left because I want to check whether it makes sense to acquire 
it in .shutdown(). Most likely it will be removed though.