* Lock user: Improve return code and fix docs
The docs state that the `DELETE` method should be used, though the controller wants `POST`. The latter seems appropriate here, as the action can be used for locking and unlocking.
Also adapted the action to return a status code based on the actual outcome of the user toggle call.
Closes#4310.
* Update clients