The method Node.lock returns a Lock object, which in turn contains a lock token. A lock token is a string that uniquely identifies a particular lock and acts as a “key” allowing a user to alter a locked node.
In order to use the lock token as a key, it must be added to the Session of the user, thus empowering that session to alter the nodes to which the lock applies. When a lock token is attached to a Session, the user of that session becomes a token holder of that lock token.
The method Node.lock automatically adds the lock token for a newly placed lock to the current Session. If a user requires more control over which lock tokens are attached to the session, the Session interface provides the methods addLockToken, removeLockToken and getLockTokens.
Note that, as mentioned above, any user with the correct lock token assumes the power to remove a lock and alter nodes under that lock. It does not have to be the lock owner.