Change locking URL to use english locale (#1345)

The locale part on the locking URL is completely arbitrary because
there's no text in the response that's going to be translated.  So I
changed it to use "en" as the first component, which we can be pretty
sure won't result in the redirect issue from #1345