move account locking functionality to SecurityUserManager so it can be called from a logged out context