users.js now uses async and locks