auth: add locking