No problem, thanks for sharing your project with everyone! Just people definitely like to use symbols in passwords.

Your fundamentals are fine, i don't think those are very serious problems compared to the average custom web app in the wild (most of which probably use plaintext passwords with no concern for sqli or xss...)

Haven't done much golang and don't have it installed on this laptop, but are string comparisons constant time?

If not, I think there is potential for a timing attack here?

if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }

Go does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.

Thanks for pointing that out. Will look into it