Better locking within handle_box_url

This improves locking in the face of parallel providers and
handling box_url parameters. This avoids downloading a box multiple
times.