Set model attrs for locked and let listeners handle redirs (bug 963640)

This moves to using the model attrs  + listeners to deal with redirects. I've also corrected the comments in the test files where they referred to incorrect status codes.

One possible improvement here might be to generalise the attr updating so that anything that returns data that that fits the model updates the attrs. One question is: Should we expect the locked state to change arbitrarily in API requests unrelated to checking the pin?