There doesn't seem to be anything guaranteeing that player usernames are unique. They should be unique to a room, if not globally. This may be ok in terms of security, since it looks like everything is using a socket to identify players (rather than username), but may be much more useful if #2 is implemented.