Rename `with_lock` to more generic `mutating` and move the env_args check to that point. This allows read-only actions to be run without requiring secrets.
