The format field was read in Handle() without synchronization while setFormat() could write it concurrently from InitLogging(). This caused a data race detected by the race detector, failing TestListBucketsAuthProxy in cmd/serve/s3. Fix by protecting all access to format with the existing mutex.