fixes #39 - restricts by username / user_id
fixes #38 - disallows duplicate naming of clients