readded session lock, but removed strange call to api_useroptions #229