Allow only legal moves from client