fix condition of locking user
fix bug of api
when updated email, set user locked to false