use try/finally for all conn locks