Lock

adds `.lock()` and `.unlock()`.

cc @calvinfo @gjohnson 
hmm could just not `return` here instead ?

i'm thinking that it's better to let the integration create the user even if there's an error with locking, since most? integrations use this to prevent dupes..