Continued a bit: (please cherry-pick)
- don't wrap command buttons in rendered="" conditions and not with ui:fragment (please name me a full replacement for all the other cases where I'm using it)
- this makes it impossible for the button's action (controller method) being executed as this depends on the life-cycle of the JSF
- it may work in viewing the JSF page but not when you submit it.
- rewrote parameter 'user' to beanHelper.user as this was already being used
- show proper lock/unlock link depending on user's account status
- added navigation rule for new user lock JSF page