The lockTags option still allowed new tags to be created on the fly if the user typed them but did not actually press enter or pick them from the dropdown. This has been fixed. However we still need to look at server-side enforcement of lockTags.