use CloudUser.run_in_user_lock