add /listroom, set room to public if no password, reject if same username