http client's shutdown should be lock-protected

http client's shutdown should be lock-protected #364