[api] do right locking when changing request or review states