Add locks for click.confirm

I assumed click.confirm uses click.prompt, but it doesn't (version 3.1)
Don't ask for saving if pwd is from cache