Do not explicitly use attr_protected
Add public #locked? method
Add request-based authentication