Add lock user function for admins

@houndci @cgruppioni @georgetmayorga

You should definitely use an object or `_path` helper and not hard-code it.