[frontend] Simple user locking, just enough to test session behaviour (and fix some bugs uncovered by this)