Add lock user function for admins

@houndci @cgruppioni @georgetmayorga

I'd just do `user.update_attribute(:locked, true)` since you never want to toggle to off