move NewUser lock into NewUser function