Login requirement must be implemented on server, not client.

[BasicAlgorithm]

If someone send "i" to server, server response with the list of online users without verification of credentials before.