a lock API in single threaded js vm. is a var true/false really too hard these days that we need an API?