The room is visible in the lobby to the host, but nobody else.
Anyone with the link can access the room.
Unlisted rooms cannot be accessed via their session ID in the URL, but regular rooms can be accessed via a hashed URL, if someone happens to find one (which, in my experience, is not unreasonable via taking a real hashed URL and slightly modifying it).
This PR adds the option to make a room unlisted.