Add lock user function for admins

@houndci @cgruppioni @georgetmayorga

Just do `User.order`, you don't have to do `User.all.order`