Unfortunately adding a few things at once, but they all go together and IMHO should not be separated.
* Add user-names. For now they are not checked, and duplicates are allowed. That will eventually get patched. Username is sent to the server as part of the identify message. I added a 'playerData' structure to sockets to hold this username (I suspect in the future we will want to store more player data, like owned tokens, so sticking this in a single object prevents polluting the socket's properties too much). I left 'identified' separate for now but we might want to add it into the playerData construct (or just use the presence of playerData to imply identified).
* Send messages to all connected users when new people connect so that we can display that information. (And obviously add the handler for this on the client)
* Add an option to manually disconnect. (I am not 100% sure that I did everything necessary to clean up the client, but I think I did, and it seems to be ok)
* Send messages to everyone connected if someone disconnects (either manually or by refreshing or by network issues). (And obviously add the handler to the client)
* Disable the host/username text boxes after connecting to prevent changing them accidentally while connected (and re-enable them on manual disconnect)
* Add css to support informational messages in the chat (and refactor some of the chat code to share code between normal messages and informational messages)

Note: The server seems to maintain disconnected sockets for some time. I suspect this was always the case, but we never noticed. Might be worth investigating how long they are held (and if we can clear them), because otherwise a malicious user can just spam connections to slowly eat the server's memory.
Merge pull request #1 from dylanryan/master

Fixes for double-auth and a super simple proof-of-concept chat. No UI yet, just console/chatlog to test.
Fix a minor CSS bug that caused horizontal scroll in the chat.
Make the server insert a 'from' field into messages it broadcasts, and make the client display it.
Make the client insert a timestamp when messages are sent (because there could be network lag), and display it as a tooltip on the username in a chat.
Add code to be able to validate, canonicalize, and HTMLiffy names, and adapt the code in various places to make use of these. Still not uniquing names yet.
Remove the messy iterate-all-sockets loop in favor of iterate-known-sockets.
HEY! LISTEN! Check this commit. I removed the re-identify song-and-dance because it isn't needed: the server basically gives a client a neutered conncetion until it successfully verifies itself, so no need to continually poke it.
Bump min client version to 0.3.2 and bump client version to 0.3.2 (probably should have been done earlier). Also, rather than having the server just send an opaque alert to the client, have it send a specific message so that the message is handled client-side.
Significantly harden the server's API endpoints. Before, a malicious client could trivially crash the server by sending null to pretty much any API endpoint. This branch/commit requires that messages received on the server match a specific format exactly or the message is not processed (an error is reported back to the client). Does NOT harden the client yet, that will be added in some subsequent commit (possibly next). NOTE: Does not handle 'optional' members on messages. This will need to be added eventually, but is not YET needed.
Unfortunately combine 2 things at once. Sorry, but it had to be done.
* Harden the client API endpoints similarly to the server endpoints.
* Fix a bug where map sync was stripping out names and sizes. This was needed because once the client had hardened endpoints, mapsyncs would get dropped.
Sorry, I didn't notice the bug until I had significant changes touching the map sync code already. Stashing would have caused me to have merge hell after, leaving the bug in place would have required comitting untested code, so I basically had to do both at once.
Add a handler to catch SIGINT/^C to the server, to inform clients that the server is going down and cleanly disconnect them. Clients alert the user and clean up a bit (but a significant amount more cleanup could probably be done)
Actually, cleaning up KNOWN_PLAYERS on the client is necessary, and I forgot that I already had app.disconnect as a thing, so I just went through that code.
It is now impossible to not send data and rows, so no need to check for them (unless we want to exclude hacked messages with 0. That is reasonable, but we also would want to exclude negatives which the old checks didn't do, so isn't that useful as a ant-hacking measure)
Merge pull request #2 from dylanryan/Names

Support for usernames (not uniqued or checked yet), log in/out messages, message timestamps

plus a bunch other stuff that got onto the same branch
Merge pull request #3 from dylanryan/hardened-api

Hardened API
Merge pull request #4 from dylanryan/clean-server-shutdown

Clean server shutdown