More reliable locking

* Checking if the original message is private is not sufficient to
  guarantee that the response will be sent privately; if the room is
  unlocked before the message can be sent, the message may not be sent
  privately. The first fix is to always attempt to lock the room when
  sending a private reply.
* Count the number of pending lock/unlock operations and only unlock
  after the final one has completed. This prevents asynchronous
  interleaving unlocking operations from causing messages not to be sent
  privately.