client: Disallow move, reset and undo without login