don't allow chat socket to emit `user` more than once per session

without this, someone could emit the `user` event themselves (like in the console or something), and pretend to be someone they're not. this checks to see if the socket already has a user attached, and only adds the person if it's a new session. 

pretty sure no one has exploited this, but fakers can get out of here :wave: