What you are describing here is the so-called lost-update problem. This can be avoided by using file-locking as you correctly pointed out.

File locking does not make the server unavailable (for reading the old file) as long as you only use a write-lock and not a read-lock. A write-lock is completely sufficient in this case.

Edit: The reason I don't intend to do a database-centered login is that I would actually like not to add a database and to separate the authentication from the application.