Update a couple permissions things, no longer allow anonymous users.

hall/hall.go

@@ -560,6 +560,12 @@ func AddClient(hall string, c Client, creds ClientCredentials) (*Hall, error) {
 		c.SetUsername(username)
 		c.SetPermissions(perms)
 
+		for _, cc := range clients {
+			if !isSystemClient(cc) && cc.Username() == username {
+				return nil, UserError("username already in use")
+			}
+		}
+
 		if !member("op", perms) {
 			if g.locked != nil {
 				m := *g.locked
@@ -1005,7 +1011,7 @@ func (g *Hall) userExists(username string) bool {
 // usernames might lead to security vulnaribilities.
 // For now, we just do the minimal validation that avoids path traversal.
 func validUsername(username string) bool {
-	return username == "" || validHallName(username)
+	return username != "" && validHallName(username)
 }
 
 // called locked