proper place to lock user account in port

[Aryeh Friedman]

right now I have:

post-install:
        pw lock user

under staging this is now called before the user is made what target should
I move this to?