Also add a mutex around API calls in preparation for future changes.

Signed-off-by: Rahix <rahix@rahix.de>