This is racy with someone recovering the lock.

You can only set it if `"#{@expires_at}:#{@token}"` has the same old value. If not, you can raise a LostLock exception or something.