Rename NodeController.index_post() to index_put()
Add ErrorsController.forbidden()
f forbidden
Add an API for locking a single node

It will throw a 403 error if it is already locked.