Currently I'm using following commands at the beginning of each function that accesses the database.
o := orm.NewOrm()
o.Using("default") // Using default, you can use other database
It feels like I should do that only once at router initialization. Can that be a security issue?
You are doing it correctly already. If you are using the default named database you can even omit the second statement. orm.NewOrm sets up a new relationship, not necessarily a new database connection. This relationship is necessary in the controller so that your data can be mapped to the correct database calls eventually when another command is issued. As far as I have seen this does not pose any security issues.