use regular for loops instead of for-in

for-in returns all enumerable properties on String, which fails for iteration
when people set enumerable properties on String (not that this is a good
idea). Using the normal for loop is probably faster, too.