[api] synchronize access to /lastnotifications