diff --git a/htmlcheck/checker.go b/htmlcheck/checker.go
index 158c57d..52dd9bc 100644
--- a/htmlcheck/checker.go
+++ b/htmlcheck/checker.go
@@ -420,7 +420,7 @@ func (ht *htmlCheckerImpl) doFlushWhitespace() {
 func (ht *htmlCheckerImpl) doFlushNewlines() {
 	// Measure the number of line breaks we have.
 	lineBreaks, crs := 0, 0
-	for ch := range []byte(ht.tempBuffer.String()) {
+	for _, ch := range []byte(ht.tempBuffer.String()) {
 		switch ch {
 		case '\r':
 			crs++
diff --git a/ui/session_mgr.go b/ui/session_mgr.go
index 5da2c02..29adf8c 100644
--- a/ui/session_mgr.go
+++ b/ui/session_mgr.go
@@ -229,24 +229,32 @@ func setSessionAnon(session *sessions.Session) {
 	}
 }
 
+var lastHitMutex sync.Mutex
+
 // AmSessionFirstTime initializes the session after it's first created.
 func AmSessionFirstTime(session *sessions.Session) {
+	lastHitMutex.Lock()
 	setSessionAnon(session)
 	session.Values["lasthit"] = time.Now()
+	lastHitMutex.Unlock()
 }
 
 // AmResetSession clears the specified session.
 func AmResetSession(session *sessions.Session) {
+	lastHitMutex.Lock()
 	for k := range session.Values {
 		delete(session.Values, k)
 	}
 	setSessionAnon(session)
 	session.Values["lasthit"] = time.Now()
+	lastHitMutex.Unlock()
 }
 
 // AmHitSession "hits" a session, updating its "last hit" time.
 func AmHitSession(session *sessions.Session) {
+	lastHitMutex.Lock()
 	session.Values["lasthit"] = time.Now()
+	lastHitMutex.Unlock()
 }
 
 /* AmSessions returns information about the currently active sessions.