Restrict room creation

Currently this only covers the server portion of the implementation,
as what constitutes a desirable UX for client side is unclear to me.

Will update this PR with additional implementation as needed.