Minimal locking to prevent two backend fetches from trying to
get at uncached req.body at the same time.