Commands require session id, and authenticate the user.

All client events now include the username.