Wrap lock/unlock calls in "su -"

This hopefully allows us to mostly deploy without entering our sudo
passwords every time.