lock_user/unlock_user changes:
 - pass user.id/app.id instead of user/app mongoid objects.
   This will help anyone with bson id does not have to fetch corresponding mongoid model to acquire user lock (eg: oo-admin-repair)
 - app.id is optional to acquire user lock. Once user lock is acquired, no one should get application lock to avoid deadlocks.
User pending op group partial changes
Remove unnecessary mongoid save! while adding pending op-group to application.
Added pending op groups for user add_ssh_keys/remove_ssh_keys
some bug fixes
Changes to user pending-op/pending-op-group
pending user op fixes