diff --git a/qr2/heartbeat.go b/qr2/heartbeat.go
index 867779d..20d261a 100644
--- a/qr2/heartbeat.go
+++ b/qr2/heartbeat.go
@@ -61,7 +61,9 @@ func heartbeat(moduleName string, conn net.PacketConn, addr net.Addr, buffer []b
 
 		if statechanged == "2" {
 			logging.Notice(moduleName, "Client session shutdown")
+			mutex.Lock()
 			removeSession(lookupAddr)
+			mutex.Unlock()
 			return
 		}
 	}
diff --git a/qr2/logins.go b/qr2/logins.go
index bf26f22..cd8bf85 100644
--- a/qr2/logins.go
+++ b/qr2/logins.go
@@ -15,6 +15,7 @@ var logins = map[uint32]*LoginInfo{}
 
 func Login(profileID uint32, gameCode string, inGameName string, consoleFriendCode uint64, publicIP string, needsExploit bool, deviceAuthenticated bool) {
 	mutex.Lock()
+	defer mutex.Unlock()
 
 	logins[profileID] = &LoginInfo{
 		ProfileID:           profileID,
@@ -26,12 +27,11 @@ func Login(profileID uint32, gameCode string, inGameName string, consoleFriendCo
 		DeviceAuthenticated: deviceAuthenticated,
 		Session:             nil,
 	}
-
-	mutex.Unlock()
 }
 
 func SetDeviceAuthenticated(profileID uint32) {
 	mutex.Lock()
+	defer mutex.Unlock()
 
 	if login, exists := logins[profileID]; exists {
 		login.DeviceAuthenticated = true
@@ -39,23 +39,18 @@ func SetDeviceAuthenticated(profileID uint32) {
 			login.Session.Data["+deviceauth"] = "1"
 		}
 	}
-
-	mutex.Unlock()
 }
 
 func Logout(profileID uint32) {
 	mutex.Lock()
+	defer mutex.Unlock()
 
 	// Delete login's session
 	if login, exists := logins[profileID]; exists {
 		if login.Session != nil {
-			mutex.Unlock()
 			removeSession(makeLookupAddr(login.Session.Addr.String()))
-			mutex.Lock()
 		}
 	}
 
 	delete(logins, profileID)
-
-	mutex.Unlock()
 }
diff --git a/qr2/session.go b/qr2/session.go
index 5ab74fc..c09992a 100644
--- a/qr2/session.go
+++ b/qr2/session.go
@@ -43,9 +43,6 @@ var (
 
 // Remove a session.
 func removeSession(addr uint64) {
-	mutex.Lock()
-	defer mutex.Unlock()
-
 	session := sessions[addr]
 	if session == nil {
 		return