[IMP] base: safer locking at user login