move Lock.token attribute into thread-local storage

see #490 for discussion.  it would be best to test this in many different environments before merging it.