Lock before checking if user state is null

If a user is removed between the user state null check and the lock, it
is possible to run into a NPE. We fix this by putting the entire user
state check inside the lock.

Bug: 211906910
Test: builds
Change-Id: I1f5f4d05f7d21db1af08e4d8cbaa48f41470dee0