tm: run reply callbacks under lock

- callback functions can modify the request from transaction (e.g., acc for
  parsing headers needed for accounting)