Removed client-facing damage

Made actual number damage server-side only, to prevent cheating by changing
damage values.  Server also detects if a proper body part was hit, and will
punish the client if there is an invalid 'hit' message sent.
Allowed client to be identified by the socket.io id
Merge pull request #2 from goakley/damagnostic

Damagnostic (I was smart enough to make a branch this time)
Minor bugfixes

Made global constants actually constant

Fixed a bug in which the cliet was told that its hit caused damage even when no
damage was registered (hit count greater than max hits)

Discovered possible issue with the audio becoming a garbled mess; needs triage