Because we don't want to keep the connection open while delaying for a
failed login, return the lock from handle_conn if the unlock should be
delayed. serve then closes the connection and sleeps before calling
Unlock().