Use NodeController._lock(), not Node.update()

Let's take advantage of that extra sanity checking

Signed-off-by: Zack Cerza <zack.cerza@inktank.com>