Removed client-facing damage

Made actual number damage server-side only, to prevent cheating by changing
damage values.  Server also detects if a proper body part was hit, and will
punish the client if there is an invalid 'hit' message sent.
Allowed client to be identified by the socket.io id
Merge pull request #2 from goakley/damagnostic

Damagnostic (I was smart enough to make a branch this time)