No. The user of data.java should do it. But you should document it well. Note that update(in data class) throws security exception if not provided with a valid coockie, so it has no sense that you lock and unlock in your data class.
My honeysuckle is blooming this year! Now to fertilize this tiny ad: