select-for-update must go thru database for locking