This just assumes 'locked' may not always be a key they return, and we should assume a droplet is *not* locked if the 'locked' key is missing. (Happy to exclude the second argument from the get so that salt-cloud will fail explicitly if the API changes.)