API has no permission restrictions on private lobbies

[Mubelotix]

Any user has as much power as the creator of the private lobby as long as they have the code.

I was able to launch a game even though the button did not display to me.

I was also able to send successful requests modifying parameters of the game before it starts, but it appears they get overridden by the legitimate session anyway.

I can craft a PR to fix this if that is convenient for you

[APuddle210]

@Mubelotix is this still an issue?

[evanpelle]

When creating a private lobby the server should probably give the host a token, which is required to update or start the game.