user-input detection on server side, including some security checks
user-actions are stored in movement-object