Add lock user function for admins

@houndci @cgruppioni @georgetmayorga

So you expect this to always set the user to locked? If so, I'd explicitly always set to locked. Having `toggle` makes me think that you're expecting to actually toggle the value.