Lock

adds `.lock()` and `.unlock()`.

cc @calvinfo @gjohnson 
`shared-lock` will `.locked=true` so it's not a bug or anything _but_ it might make our integrations more robust if we require a callback, so not sure which way to go.

both sound good to me... :/