diff --git a/cockatrice/src/cardzone.cpp b/cockatrice/src/cardzone.cpp
index f64a5237..f6053ac4 100644
--- a/cockatrice/src/cardzone.cpp
+++ b/cockatrice/src/cardzone.cpp
@@ -157,7 +157,7 @@ void CardZone::moveAllToZone()
 	// Cards need to be moved in reverse order so that the other
 	// cards' list index doesn't change
 	for (int i = cards.size() - 1; i >= 0; i--)
-		player->sendGameCommand(new Command_MoveCard(-1, getName(), cards.at(i)->getId(), getName(), targetX));
+		player->sendGameCommand(new Command_MoveCard(-1, getName(), cards.at(i)->getId(), targetZone, targetX));
 }
 
 QPointF CardZone::closestGridPoint(const QPointF &point)
diff --git a/common/protocol.cpp b/common/protocol.cpp
index f536454c..f8a44041 100644
--- a/common/protocol.cpp
+++ b/common/protocol.cpp
@@ -142,6 +142,7 @@ void ProtocolResponse::initializeHash()
 	responseHash.insert("invalid_command", RespInvalidCommand);
 	responseHash.insert("name_not_found", RespNameNotFound);
 	responseHash.insert("login_needed", RespLoginNeeded);
+	responseHash.insert("function_not_allowed", RespFunctionNotAllowed);
 	responseHash.insert("context_error", RespContextError);
 	responseHash.insert("wrong_password", RespWrongPassword);
 	responseHash.insert("spectators_not_allowed", RespSpectatorsNotAllowed);
diff --git a/common/protocol_datastructures.h b/common/protocol_datastructures.h
index 218845da..50d216c3 100644
--- a/common/protocol_datastructures.h
+++ b/common/protocol_datastructures.h
@@ -8,7 +8,7 @@
 
 class DeckList;
 
-enum ResponseCode { RespNothing, RespOk, RespInvalidCommand, RespInvalidData, RespNameNotFound, RespLoginNeeded, RespContextError, RespWrongPassword, RespSpectatorsNotAllowed };
+enum ResponseCode { RespNothing, RespOk, RespInvalidCommand, RespInvalidData, RespNameNotFound, RespLoginNeeded, RespFunctionNotAllowed, RespContextError, RespWrongPassword, RespSpectatorsNotAllowed };
 
 // PrivateZone: Contents of the zone are always visible to the owner,
 // but not to anyone else.
diff --git a/common/server_game.cpp b/common/server_game.cpp
index fbad248e..1771bfdb 100644
--- a/common/server_game.cpp
+++ b/common/server_game.cpp
@@ -146,7 +146,6 @@ void Server_Game::stopGameIfFinished()
 		Server_Player *player = playerIterator.next().value();
 		player->sendProtocolItem(new Event_GameStateChanged(gameId, gameStarted, -1, -1, getGameState(player)));
 	}
-
 }
 
 ResponseCode Server_Game::checkJoin(const QString &_password, bool spectator)
@@ -185,6 +184,8 @@ void Server_Game::removePlayer(Server_Player *player)
 	
 	if (!getPlayerCount())
 		deleteLater();
+	else
+		stopGameIfFinished();
 	qobject_cast<Server *>(parent())->broadcastGameListUpdate(this);
 }
 
diff --git a/servatrice/src/serversocketinterface.cpp b/servatrice/src/serversocketinterface.cpp
index b20146fc..af53c744 100644
--- a/servatrice/src/serversocketinterface.cpp
+++ b/servatrice/src/serversocketinterface.cpp
@@ -161,6 +161,9 @@ bool ServerSocketInterface::deckListHelper(DeckList_Directory *folder)
 
 ResponseCode ServerSocketInterface::cmdDeckList(Command_DeckList *cmd)
 {
+	if (authState != PasswordRight)
+		return RespFunctionNotAllowed;
+	
 	servatrice->checkSql();
 	
 	DeckList_Directory *root = new DeckList_Directory(QString());
@@ -175,6 +178,9 @@ ResponseCode ServerSocketInterface::cmdDeckList(Command_DeckList *cmd)
 
 ResponseCode ServerSocketInterface::cmdDeckNewDir(Command_DeckNewDir *cmd)
 {
+	if (authState != PasswordRight)
+		return RespFunctionNotAllowed;
+	
 	servatrice->checkSql();
 	
 	int folderId = getDeckPathId(cmd->getPath());
@@ -214,6 +220,9 @@ void ServerSocketInterface::deckDelDirHelper(int basePathId)
 
 ResponseCode ServerSocketInterface::cmdDeckDelDir(Command_DeckDelDir *cmd)
 {
+	if (authState != PasswordRight)
+		return RespFunctionNotAllowed;
+	
 	servatrice->checkSql();
 	
 	int basePathId = getDeckPathId(cmd->getPath());
@@ -225,6 +234,9 @@ ResponseCode ServerSocketInterface::cmdDeckDelDir(Command_DeckDelDir *cmd)
 
 ResponseCode ServerSocketInterface::cmdDeckDel(Command_DeckDel *cmd)
 {
+	if (authState != PasswordRight)
+		return RespFunctionNotAllowed;
+	
 	servatrice->checkSql();
 	
 	QSqlQuery query;
@@ -245,6 +257,9 @@ ResponseCode ServerSocketInterface::cmdDeckDel(Command_DeckDel *cmd)
 
 ResponseCode ServerSocketInterface::cmdDeckUpload(Command_DeckUpload *cmd)
 {
+	if (authState != PasswordRight)
+		return RespFunctionNotAllowed;
+	
 	servatrice->checkSql();
 	
 	if (!cmd->getDeck())
@@ -297,6 +312,9 @@ DeckList *ServerSocketInterface::getDeckFromDatabase(int deckId)
 
 ResponseCode ServerSocketInterface::cmdDeckDownload(Command_DeckDownload *cmd)
 {
+	if (authState != PasswordRight)
+		return RespFunctionNotAllowed;
+	
 	DeckList *deck;
 	try {
 		deck = getDeckFromDatabase(cmd->getDeckId());