Add lock user function for admins

@houndci @cgruppioni @georgetmayorga

could this have been in the same controller as lock_users?