api of lock/unlock user