Lock / unlock users

Allow super users to lock or unlock other user accounts from their account pages.

This fix requires the `lock-users` branch for the API server and application.