unless locked
          user = user_info(request.headers['HTTP_AUTHORIZATION'])
          username = user['name']

          # Generic name that makes sense in the lock toast (EE has the actual username)