added is_locked to Account and User and send it when updating User