Atomic/locked "allocation" of table row?

CREATE TABLE tunnel (
    username    integer UNIQUE, -- ranges from 1 to ~250.000
    password    varchar
);

I need to write a function to "allocate" an empty "tunnel" on a
prepopulated table where all fields, except username, IS NULL by default.

In essence this function would do;

UPDATE SET password = 'mysecret' WHERE username = ( SELECT username FROM
tunnel WHERE password IS NULL LIMIT 1 );

But i need to know that no other concurrently running session would
allocate that specific row in between the SELECT ... and the UPDATE.

Could this be done atomically somehow? Is it necessary to add some kind
of locking? Help?

--
Sten Daniel Soersdal