Use socket session id to know which db document to update
Don't let the DOM dictate if the client is the assassin