send `is_locked` when updating user