Limited your ability to remove a requested song to only ones you're session has added. This is only a client-side limitation; if someone wants to send the remove command over socket.io, they totally can get around it. Frankly, I think this is sufficient.