Index: TFP-WebServer/WebServer/src/Permissions/AdminApiTokens.cs
===================================================================
--- TFP-WebServer/WebServer/src/Permissions/AdminApiTokens.cs	(revision 473)
+++ TFP-WebServer/WebServer/src/Permissions/AdminApiTokens.cs	(revision 474)
@@ -40,20 +40,26 @@
 
 		public void AddToken (string _name, string _secret, int _permissionLevel) {
-			ApiToken apiToken = new ApiToken (_name, _secret, _permissionLevel);
-			tokens [_name] = apiToken;
-			Parent.Save ();
+			lock (Parent) {
+				ApiToken apiToken = new ApiToken (_name, _secret, _permissionLevel);
+				tokens[_name] = apiToken;
+				Parent.Save ();
+			}
 		}
 
 		public bool RemoveToken (string _name) {
-			bool removed = tokens.Remove (_name);
-			if (removed) {
-				Parent.Save ();
+			lock (Parent) {
+				bool removed = tokens.Remove (_name);
+				if (removed) {
+					Parent.Save ();
+				}
+
+				return removed;
 			}
-
-			return removed;
 		}
 
 		public Dictionary<string, ApiToken> GetTokens () {
-			return tokens;
+			lock (Parent) {
+				return tokens;
+			}
 		}
 
@@ -113,13 +119,15 @@
 
 		public int GetPermissionLevel (string _name, string _secret) {
-			if (tokens.TryGetValue (_name, out ApiToken apiToken) && apiToken.Secret == _secret) {
-				return apiToken.PermissionLevel;
+			lock (Parent) {
+				if (tokens.TryGetValue (_name, out ApiToken apiToken) && apiToken.Secret == _secret) {
+					return apiToken.PermissionLevel;
+				}
+
+				if (IsCommandlineToken (_name, _secret)) {
+					return 0;
+				}
+
+				return int.MaxValue;
 			}
-
-			if (IsCommandlineToken (_name, _secret)) {
-				return 0;
-			}
-
-			return int.MaxValue;
 		}
 
Index: TFP-WebServer/WebServer/src/Permissions/AdminWebModules.cs
===================================================================
--- TFP-WebServer/WebServer/src/Permissions/AdminWebModules.cs	(revision 473)
+++ TFP-WebServer/WebServer/src/Permissions/AdminWebModules.cs	(revision 474)
@@ -41,5 +41,5 @@
 
 		public void AddModule (WebModule _module) {
-			lock (this) {
+			lock (Parent) {
 				allModulesList.Clear ();
 				
@@ -50,5 +50,5 @@
 
 		public bool RemoveModule (string _module) {
-			lock (this) {
+			lock (Parent) {
 				allModulesList.Clear ();
 				
@@ -63,5 +63,5 @@
 
 		public List<WebModule> GetModules () {
-			lock (this) {
+			lock (Parent) {
 				if (allModulesList.Count != 0) {
 					return allModulesList;
@@ -259,5 +259,5 @@
 			_module.IsDefault = true;
 			
-			lock (this) {
+			lock (Parent) {
 				allModulesList.Clear ();
 				knownModules [_module.Name] = _module;
@@ -270,5 +270,5 @@
 			}
 
-			lock (this) {
+			lock (Parent) {
 				return knownModules.ContainsKey (_module);
 			}
@@ -276,13 +276,17 @@
 
 		public bool ModuleAllowedWithLevel (string _module, int _level) {
-			return GetModule (_module).LevelGlobal >= _level;
+			lock (Parent) {
+				return GetModule (_module).LevelGlobal >= _level;
+			}
 		}
 
 		public WebModule GetModule (string _module) {
-			if (modules.TryGetValue (_module, out WebModule result)) {
-				return result;
-			}
-
-			return knownModules.TryGetValue (_module, out result) ? result : defaultModulePermission;
+			lock (Parent) {
+				if (modules.TryGetValue (_module, out WebModule result)) {
+					return result;
+				}
+
+				return knownModules.TryGetValue (_module, out result) ? result : defaultModulePermission;
+			}
 		}
 
Index: TFP-WebServer/WebServer/src/Permissions/AdminWebUsers.cs
===================================================================
--- TFP-WebServer/WebServer/src/Permissions/AdminWebUsers.cs	(revision 473)
+++ TFP-WebServer/WebServer/src/Permissions/AdminWebUsers.cs	(revision 474)
@@ -43,23 +43,29 @@
 
 		public void AddUser (string _name, string _password, PlatformUserIdentifierAbs _userIdentifier, PlatformUserIdentifierAbs _crossPlatformIdentifier) {
-			WebUser p = new WebUser (_name, _password, _userIdentifier, _crossPlatformIdentifier);
-			
-			// TODO: Check if another name exists with the same (crossplatform)identifier, remove that
-			users [_name] = p;
-			
-			Parent.Save ();
+			lock (Parent) {
+				WebUser p = new WebUser (_name, _password, _userIdentifier, _crossPlatformIdentifier);
+
+				// TODO: Check if another name exists with the same (crossplatform)identifier, remove that
+				users[_name] = p;
+
+				Parent.Save ();
+			}
 		}
 
 		public bool RemoveUser (string _name) {
-			bool removed = users.Remove (_name);
-			if (removed) {
-				Parent.Save ();
+			lock (Parent) {
+				bool removed = users.Remove (_name);
+				if (removed) {
+					Parent.Save ();
+				}
+
+				return removed;
 			}
-
-			return removed;
 		}
 
 		public Dictionary<string, WebUser> GetUsers () {
-			return users;
+			lock (Parent) {
+				return users;
+			}
 		}
 
@@ -134,26 +140,30 @@
 
 		public bool TryGetUser (string _name, string _password, out WebUser _result) {
-			if (users.TryGetValue (_name, out _result) && _result.ValidatePassword (_password)) {
-				return true;
+			lock (Parent) {
+				if (users.TryGetValue (_name, out _result) && _result.ValidatePassword (_password)) {
+					return true;
+				}
+
+				_result = default;
+				return false;
 			}
-
-			_result = default;
-			return false;
 		}
 
 		public bool HasUser (PlatformUserIdentifierAbs _platformUser, PlatformUserIdentifierAbs _crossPlatformUser, out WebUser _result) {
-			_result = default;
-			
-			foreach ((string _, WebUser webUser) in users) {
-				if (!PlatformUserIdentifierAbs.Equals (webUser.PlatformUser, _platformUser) ||
-				    !PlatformUserIdentifierAbs.Equals (webUser.CrossPlatformUser, _crossPlatformUser)) {
-					continue;
+			lock (Parent) {
+				_result = default;
+
+				foreach ((string _, WebUser webUser) in users) {
+					if (!PlatformUserIdentifierAbs.Equals (webUser.PlatformUser, _platformUser) ||
+					    !PlatformUserIdentifierAbs.Equals (webUser.CrossPlatformUser, _crossPlatformUser)) {
+						continue;
+					}
+
+					_result = webUser;
+					return true;
 				}
 
-				_result = webUser;
-				return true;
+				return false;
 			}
-
-			return false;
 		}
 
Index: TFP-WebServer/WebServer/src/Web.cs
===================================================================
--- TFP-WebServer/WebServer/src/Web.cs	(revision 473)
+++ TFP-WebServer/WebServer/src/Web.cs	(revision 474)
@@ -236,4 +236,5 @@
 				}
 
+				// Force parsing the URL path as UTF8 so special characters get decoded properly
 				request.ContentEncoding = Encoding.UTF8;
 				RequestContext context = new RequestContext (requestPath, request, response, conn, permissionLevel);